CVE-2024-3912

CriticalCVSS 9.8/10Last modified Nov 3, 2026

Description

Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands on the device.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
ASUSDSL-N17U>= earlier, < 1.1.2.3_792
ASUSDSL-N55U_C1>= earlier, < 1.1.2.3_792
ASUSDSL-N55U_D1>= earlier, < 1.1.2.3_792
ASUSDSL-N66U>= earlier, < 1.1.2.3_792
ASUSDSL-N12U_C1>= earlier, < 1.1.2.3_807
ASUSDSL-N12U_D1>= earlier, < 1.1.2.3_807
ASUSDSL-N14U>= earlier, < 1.1.2.3_807
ASUSDSL-N14U_B1>= earlier, < 1.1.2.3_807
ASUSDSL-N16>= earlier, < 1.1.2.3_999
ASUSDSL-AC51>= earlier, < 1.1.2.3_999
ASUSDSL-AC750>= earlier, < 1.1.2.3_999
ASUSDSL-AC52U>= earlier, < 1.1.2.3_999
ASUSDSL-AC55U>= earlier, < 1.1.2.3_999
ASUSDSL-AC56U>= earlier, < 1.1.2.3_999
ASUSDSL-N10_C1All
ASUSDSL-N10_D1All
ASUSDSL-N10P_C1All
ASUSDSL-N12E_C1All
ASUSDSL-N16PAll
ASUSDSL-N16UAll
ASUSDSL-AC52All
ASUSDSL-AC55All
asusdsl-n66u_firmware< 1.1.2.3_792
asusdsl-n12u_c1_firmware< 1.1.2.3_807
asusdsl-ac55_firmware< 1.1.2.3_999
asusdsl-n10_c1_firmware<= *

References

Timeline

Published
Jun 14, 2024
Last modified
Nov 3, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-391235.4In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitizCVE-2024-391245.4In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.CVE-2024-391255.4Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.CVE-2024-391265.4Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.CVE-2024-391295.3Heap Buffer Overflow vulnerability in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the function PushTSBuf() at /sCVE-2024-39135.9An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time afteCVE-2024-391307.5A NULL Pointer Dereference discovered in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the function DumpOneStream(CVE-2024-391326.5A NULL Pointer Dereference vulnerability in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the function VerifyCommaCVE-2024-391334.3Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() fCVE-2024-391347.5A Stack Buffer Overflow vulnerability in zziplibv 0.13.77 allows attackers to cause a denial of service via the __zzip_fetch_disk_trailer() CVE-2024-39146.5Use after free in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2024-391435.4A stored cross-site scripting (XSS) vulnerability exists in ResidenceCMS 2.10.1 that allows a low-privilege user to create malicious propert
CVE-2024-3912: Critical severity, CVSS 9.8 | Vulnix