Critical Security Vulnerability CVE-2024-3912 (CVSS 9.8) Hits ASUS Routers

by do son · Published · Updated

CVE-2024-3912

Taiwan’s CERT has issued a critical security alert regarding a severe vulnerability (CVE-2024-3912) found in multiple ASUS router models. The flaw, discovered by security researcher Carlos Köpke, allows remote attackers to execute commands on vulnerable devices without authentication, putting millions of users at risk.

CVE-2024-3912

CVE-2024-3912 (CVSS 9.8) is an arbitrary firmware upload vulnerability that can be exploited by remote attackers without requiring authentication. This flaw grants attackers the ability to execute system commands on the device, leading to potential control over the router and connected network.

The impacted ASUS router models include:

  • DSL-N17U, DSL-N55U_C1, DSL-N55U_D1, DSL-N66U: Upgrade to firmware version 1.1.2.3_792 or later.
  • DSL-N12U_C1, DSL-N12U_D1, DSL-N14U, DSL-N14U_B1: Upgrade to firmware version 1.1.2.3_807 or later.
  • DSL-N16, DSL-AC51, DSL-AC750, DSL-AC52U, DSL-AC55U, DSL-AC56U: Upgrade to firmware version 1.1.2.3_999 or later.
  • DSL-N10_C1, DSL-N10_D1, DSL-N10P_C1, DSL-N12E_C1, DSL-N16P, DSL-N16U, DSL-AC52, DSL-AC55: End-of-life (EoL) models, replacement recommended.

This vulnerability is particularly dangerous due to its high severity and the potential for exploitation by remote attackers. The ability to upload arbitrary firmware and execute commands can lead to complete compromise of the router, allowing attackers to intercept network traffic, deploy additional malicious payloads, and access sensitive information.

ASUS has released firmware updates to address this vulnerability for several affected models. Users are urged to upgrade to the specified firmware versions to mitigate the risk:

  • DSL-N17U, DSL-N55U_C1, DSL-N55U_D1, DSL-N66U: Upgrade to firmware version 1.1.2.3_792 or later.
  • DSL-N12U_C1, DSL-N12U_D1, DSL-N14U, DSL-N14U_B1: Upgrade to firmware version 1.1.2.3_807 or later.
  • DSL-N16, DSL-AC51, DSL-AC750, DSL-AC52U, DSL-AC55U, DSL-AC56U: Upgrade to firmware version 1.1.2.3_999 or later.

For models that have reached their end-of-life (EoL) and will not receive updates, ASUS recommends replacing these devices. If immediate replacement is not feasible, it is crucial to disable any services accessible from the internet, such as remote access from WAN, port forwarding, DDNS, VPN server, DMZ, and port triggering. For more information and to download the latest firmware, visit the ASUS support page.

Tags: arbitrary firmware uploadASUSCVE-2024-3912