Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

ASUS Router - Upload arbitrary firmware

CVE-2024-3912 · published 2 years ago
Summary

Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands on the device.

What to do
  • Update asus dsl-n17u to version 1.1.2.3_792 or later.
  • Update asus dsl-n55u_c1 to version 1.1.2.3_792 or later.
  • Update asus dsl-n55u_d1 to version 1.1.2.3_792 or later.
  • Update asus dsl-n66u to version 1.1.2.3_792 or later.
  • Update asus dsl-n12u_c1 to version 1.1.2.3_807 or later.
  • Update asus dsl-n12u_d1 to version 1.1.2.3_807 or later.
  • Update asus dsl-n14u to version 1.1.2.3_807 or later.
  • Update asus dsl-n14u_b1 to version 1.1.2.3_807 or later.
  • Update asus dsl-n16 to version 1.1.2.3_999 or later.
  • Update asus dsl-ac51 to version 1.1.2.3_999 or later.
  • Update asus dsl-ac750 to version 1.1.2.3_999 or later.
  • Update asus dsl-ac52u to version 1.1.2.3_999 or later.
  • Update asus dsl-ac55u to version 1.1.2.3_999 or later.
  • Update asus dsl-ac56u to version 1.1.2.3_999 or later.
Affected software
VendorProductAffected versions
asus dsl-n17u < 1.1.2.3_792
asus dsl-n55u_c1 < 1.1.2.3_792
asus dsl-n55u_d1 < 1.1.2.3_792
asus dsl-n66u < 1.1.2.3_792
asus dsl-n12u_c1 < 1.1.2.3_807
asus dsl-n12u_d1 < 1.1.2.3_807
asus dsl-n14u < 1.1.2.3_807
asus dsl-n14u_b1 < 1.1.2.3_807
asus dsl-n16 < 1.1.2.3_999
asus dsl-ac51 < 1.1.2.3_999
asus dsl-ac750 < 1.1.2.3_999
asus dsl-ac52u < 1.1.2.3_999
asus dsl-ac55u < 1.1.2.3_999
asus dsl-ac56u < 1.1.2.3_999
asus dsl-n10_c1 All
asus dsl-n10_d1 All
asus dsl-n10p_c1 All
asus dsl-n12e_c1 All
asus dsl-n16p All
asus dsl-n16u All
asus dsl-ac52 All
asus dsl-ac55 All
Original advisory text
ASUS Router - Upload arbitrary firmware
Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands on the device.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-434Unrestricted File Upload
Timeline
Published14 Jun 2024
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2024-3912 · NVD
CVE-2024-3912 · MITRE
Track software like this
Free during beta