CVE-2024-0401 - OpenCVE

ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS ExpertWiFi, ASUS RT-AX55, ASUS RT-AX58U, ASUS RT-AC67U, ASUS RT-AC68R, ASUS RT-AC68U, ASUS RT-AX86, ASUS RT-AC86U, ASUS RT-AX88U, and ASUS RT-AX3000.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://vulncheck.com/advisories/asus-ovpn-rce

History

No history.

MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2024-05-20T16:55:18.891Z

Updated: 2024-08-01T18:04:49.502Z

Reserved: 2024-01-10T15:27:41.121Z

Link: CVE-2024-0401

Vulnrichment

Updated: 2024-08-01T18:04:49.502Z

NVD

Status : Awaiting Analysis

Published: 2024-05-20T17:15:09.223

Modified: 2024-05-20T19:34:58.277

Link: CVE-2024-0401

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-0401", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2024-01-10T15:27:41.121Z", "datePublished": "2024-05-20T16:55:18.891Z", "dateUpdated": "2024-08-01T18:04:49.502Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ExpertWiFi", "vendor": "ASUS", "versions": [{"lessThan": "3.0.0.6.102_44544", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RT-AX55", "vendor": "ASUS", "versions": [{"lessThan": "3.0.0.4.386_52303", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RT-AX58U", "vendor": "ASUS", "versions": [{"lessThan": "3.0.0.4.388_24762", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RT-AC67U", "vendor": "ASUS", "versions": [{"lessThan": "3.0.0.4.386_51685", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RT-AC68R", "vendor": "ASUS", "versions": [{"lessThan": "3.0.0.4.386_51685", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RT-AC68U", "vendor": "ASUS", "versions": [{"lessThan": "3.0.0.4.386_51685", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RT-AX86 Series", "vendor": "ASUS", "versions": [{"lessThan": "3.0.0.4.388_24243", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RT-AC86U", "vendor": "ASUS", "versions": [{"lessThan": "3.0.0.4.386_51925", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RT-AX88U", "vendor": "ASUS", "versions": [{"lessThan": "3.0.0.4.388_24209", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RT-AX3000", "vendor": "ASUS", "versions": [{"lessThan": "3.0.0.4.388_24762", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Jacob Baines"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS ExpertWiFi, ASUS RT-AX55, ASUS RT-AX58U, ASUS RT-AC67U, ASUS RT-AC68R, ASUS RT-AC68U, ASUS RT-AX86, ASUS RT-AC86U, ASUS RT-AX88U, and ASUS RT-AX3000.<br><br>"}], "value": "ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS ExpertWiFi, ASUS RT-AX55, ASUS RT-AX58U, ASUS RT-AC67U, ASUS RT-AC68R, ASUS RT-AC68U, ASUS RT-AX86, ASUS RT-AC86U, ASUS RT-AX88U, and ASUS RT-AX3000."}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2024-05-20T16:55:18.891Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://vulncheck.com/advisories/asus-ovpn-rce"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Apply the vendor provided firmware update.<br>"}], "value": "Apply the vendor provided firmware update."}], "source": {"discovery": "UNKNOWN"}, "title": "ASUS OVPN RCE", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-0401", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-22T14:51:52.209755Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:asus:rt-ax58u:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ax58u", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.388_24762", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ac67u:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ac67u", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51685", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ac68r:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ac68r", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51685", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:asus:expertwifi:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "expertwifi", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.6.102_44544", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ax55:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ax55", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_52303", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ac68u:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ac68u", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51685", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ax86_series:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ax86_series", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.388_24243", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ac86u:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ac86u", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51925", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ac88u:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ac88u", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.388_24209", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ax3000:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ax3000", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.388_24762", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ac68p:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ac68p", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51685", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ac1900:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ac1900", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51685", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ac1900u:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ac1900u", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51685", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ac2900:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ac2900", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51925", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:zenwifi_xt8:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "zenwifi_xt8", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.388_24621", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:58:40.749Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:04:49.502Z"}, "title": "CVE Program Container", "references": [{"tags": ["third-party-advisory", "x_transferred"], "url": "https://vulncheck.com/advisories/asus-ovpn-rce"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://vulncheck.com/advisories/asus-ovpn-rce", "tags": ["third-party-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:04:49.502Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-0401", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-22T14:51:52.209755Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:asus:rt-ax58u:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ax58u", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.388_24762", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ac67u:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ac67u", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51685", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ac68r:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ac68r", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51685", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:asus:expertwifi:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "expertwifi", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.6.102_44544", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ax55:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ax55", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_52303", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ac68u:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ac68u", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51685", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ax86_series:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ax86_series", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.388_24243", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ac86u:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ac86u", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51925", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ac88u:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ac88u", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.388_24209", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ax3000:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ax3000", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.388_24762", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ac68p:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ac68p", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51685", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ac1900:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ac1900", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51685", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ac1900u:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ac1900u", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51685", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ac2900:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ac2900", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51925", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:zenwifi_xt8:0:*:*:*:*:*:*:*"], "vendor": "asus", "product": "zenwifi_xt8", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.388_24621", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-22T15:16:22.837Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "ASUS OVPN RCE", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Jacob Baines"}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ASUS", "product": "ExpertWiFi", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.6.102_44544", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "RT-AX55", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_52303", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "RT-AX58U", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.388_24762", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "RT-AC67U", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51685", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "RT-AC68R", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51685", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "RT-AC68U", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51685", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "RT-AX86 Series", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.388_24243", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "RT-AC86U", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51925", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "RT-AX88U", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.388_24209", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "RT-AX3000", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.388_24762", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Apply the vendor provided firmware update.", "supportingMedia": [{"type": "text/html", "value": "Apply the vendor provided firmware update.<br>", "base64": false}]}], "references": [{"url": "https://vulncheck.com/advisories/asus-ovpn-rce", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS ExpertWiFi, ASUS RT-AX55, ASUS RT-AX58U, ASUS RT-AC67U, ASUS RT-AC68R, ASUS RT-AC68U, ASUS RT-AX86, ASUS RT-AC86U, ASUS RT-AX88U, and ASUS RT-AX3000.", "supportingMedia": [{"type": "text/html", "value": "ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS ExpertWiFi, ASUS RT-AX55, ASUS RT-AX58U, ASUS RT-AC67U, ASUS RT-AC68R, ASUS RT-AC68U, ASUS RT-AX86, ASUS RT-AC86U, ASUS RT-AX88U, and ASUS RT-AX3000.<br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2024-05-20T16:55:18.891Z"}}}, "cveMetadata": {"cveId": "CVE-2024-0401", "state": "PUBLISHED", "dateUpdated": "2024-08-01T18:04:49.502Z", "dateReserved": "2024-01-10T15:27:41.121Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2024-05-20T16:55:18.891Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.1"}