7.2

CVE-2024-0401

ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS ExpertWiFi, ASUS RT-AX55, ASUS RT-AX58U, ASUS RT-AC67U, ASUS RT-AC68R, ASUS RT-AC68U, ASUS RT-AX86, ASUS RT-AC86U, ASUS RT-AX88U, and ASUS RT-AX3000.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Daten sind bereitgestellt durch das CVE Programm von Authorized Data Publishers (ADP) (Unstrukturiert)
Vendorasus
≫
Product rt-ax58u
Default Statusunknown
Version < 3.0.0.4.388_24762
Version 0
Status affected
Vendorasus
≫
Product rt-ac67u
Default Statusunknown
Version < 3.0.0.4.386_51685
Version 0
Status affected
Vendorasus
≫
Product rt-ac68r
Default Statusunknown
Version < 3.0.0.4.386_51685
Version 0
Status affected
Vendorasus
≫
Product expertwifi
Default Statusunknown
Version < 3.0.0.6.102_44544
Version 0
Status affected
Vendorasus
≫
Product rt-ax55
Default Statusunknown
Version < 3.0.0.4.386_52303
Version 0
Status affected
Vendorasus
≫
Product rt-ac68u
Default Statusunknown
Version < 3.0.0.4.386_51685
Version 0
Status affected
Vendorasus
≫
Product rt-ax86_series
Default Statusunknown
Version < 3.0.0.4.388_24243
Version 0
Status affected
Vendorasus
≫
Product rt-ac86u
Default Statusunknown
Version < 3.0.0.4.386_51925
Version 0
Status affected
Vendorasus
≫
Product rt-ac88u
Default Statusunknown
Version < 3.0.0.4.388_24209
Version 0
Status affected
Vendorasus
≫
Product rt-ax3000
Default Statusunknown
Version < 3.0.0.4.388_24762
Version 0
Status affected
Vendorasus
≫
Product rt-ac68p
Default Statusunknown
Version < 3.0.0.4.386_51685
Version 0
Status affected
Vendorasus
≫
Product rt-ac1900
Default Statusunknown
Version < 3.0.0.4.386_51685
Version 0
Status affected
Vendorasus
≫
Product rt-ac1900u
Default Statusunknown
Version < 3.0.0.4.386_51685
Version 0
Status affected
Vendorasus
≫
Product rt-ac2900
Default Statusunknown
Version < 3.0.0.4.386_51925
Version 0
Status affected
Vendorasus
≫
Product zenwifi_xt8
Default Statusunknown
Version < 3.0.0.4.388_24621
Version 0
Status affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 5.37% 0.897
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
disclosure@vulncheck.com 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.