CVE-2024-3079 - Vulnerability Details - OpenCVE

Certain models of ASUS routers have buffer overflow vulnerabilities, allowing remote attackers with administrative privileges to execute arbitrary commands on the device.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.03038.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Asus	Rt-ac68u Firmware Rt-ac86u Firmware Rt-ax57 Firmware Rt-ax58u Firmware Rt-ax88u Firmware Zenwifi Xt8 Firmware Zenwifi Xt8 V2 Firmware

No data.

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-31685	Certain models of ASUS routers have buffer overflow vulnerabilities, allowing remote attackers with administrative privileges to execute arbitrary commands on the device.

Fixes

Solution

Update ZenWiFi XT8 to version 3.0.0.4.388_24621 or later Update ZenWiFi XT8 V2 to version 3.0.0.4.388_24621 or later Update RT-AX88U to version 3.0.0.4.388_24209 or later Update RT-AX58U to version 3.0.0.4.388_24762 or later Update RT-AX57 to version 3.0.0.4.386_52303 or later Update RT-AC86U to version 3.0.0.4.386_51925 or later Update RT-AC68U to version 3.0.0.4.386_51685 or later

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.twcert.org.tw/en/cp-139-7858-3c978-2.html
https://www.twcert.org.tw/tw/cp-132-7857-5726f-1.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2024-06-14T02:32:21.718Z

Updated: 2024-08-01T19:32:42.604Z

Reserved: 2024-03-29T07:18:04.796Z

Link: CVE-2024-3079

Vulnrichment

Updated: 2024-06-17T19:28:30.035Z

NVD

Status : Awaiting Analysis

Published: 2024-06-14T03:15:13.540

Modified: 2024-11-21T09:28:51.060

Link: CVE-2024-3079

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-3079", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2024-03-29T07:18:04.796Z", "datePublished": "2024-06-14T02:32:21.718Z", "dateUpdated": "2024-08-01T19:32:42.604Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ZenWiFi XT8", "vendor": "ASUS", "versions": [{"lessThanOrEqual": "3.0.0.4.388_24609", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "ZenWiFi XT8 V2", "vendor": "ASUS", "versions": [{"lessThanOrEqual": "3.0.0.4.388_24609", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RT-AX88U", "vendor": "ASUS", "versions": [{"lessThanOrEqual": "3.0.0.4.388_24198", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RT-AX58U", "vendor": "ASUS", "versions": [{"lessThanOrEqual": "3.0.0.4.388_23925", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RT-AX57", "vendor": "ASUS", "versions": [{"lessThanOrEqual": "3.0.0.4.386_52294", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RT-AC86U", "vendor": "ASUS", "versions": [{"lessThanOrEqual": "3.0.0.4.386_51915", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RT-AC68U", "vendor": "ASUS", "versions": [{"lessThanOrEqual": "3.0.0.4.386_51668", "status": "affected", "version": "earlier", "versionType": "custom"}]}], "datePublic": "2024-06-14T02:22:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Certain models of ASUS routers have buffer overflow vulnerabilities, allowing remote attackers with administrative privileges to execute arbitrary commands on the device."}], "value": "Certain models of ASUS routers have buffer overflow vulnerabilities, allowing remote attackers with administrative privileges to execute arbitrary commands on the device."}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "description": "CWE-121: Stack-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-06-14T02:59:31.013Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-7857-5726f-1.html"}, {"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/en/cp-139-7858-3c978-2.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Update ZenWiFi XT8 to version 3.0.0.4.388_24621 or later</span><br><span style=\"background-color: rgb(255, 255, 255);\">Update ZenWiFi XT8 V2 to version 3.0.0.4.388_24621 or later</span><br><span style=\"background-color: rgb(255, 255, 255);\">Update RT-AX88U to version 3.0.0.4.388_24209 or later</span><br><span style=\"background-color: rgb(255, 255, 255);\">Update RT-AX58U to version 3.0.0.4.388_24762 or later</span><br><span style=\"background-color: rgb(255, 255, 255);\">Update RT-AX57 to version 3.0.0.4.386_52303 or later</span><br><span style=\"background-color: rgb(255, 255, 255);\">Update RT-AC86U to version 3.0.0.4.386_51925 or later</span><br><span style=\"background-color: rgb(255, 255, 255);\">Update RT-AC68U to version 3.0.0.4.386_51685 or later</span>\n\n<br>"}], "value": "Update ZenWiFi XT8 to version 3.0.0.4.388_24621 or later\nUpdate ZenWiFi XT8 V2 to version 3.0.0.4.388_24621 or later\nUpdate RT-AX88U to version 3.0.0.4.388_24209 or later\nUpdate RT-AX58U to version 3.0.0.4.388_24762 or later\nUpdate RT-AX57 to version 3.0.0.4.386_52303 or later\nUpdate RT-AC86U to version 3.0.0.4.386_51925 or later\nUpdate RT-AC68U to version 3.0.0.4.386_51685 or later"}], "source": {"advisory": "TVN-202406002", "discovery": "EXTERNAL"}, "title": "ASUS Router - Stack-based Buffer Overflow", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "asus", "product": "rt-ax58u_firmware", "cpes": ["cpe:2.3:o:asus:rt-ax58u_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.0.0.4.388_24762", "versionType": "custom"}]}, {"vendor": "asus", "product": "rt-ax88u_firmware", "cpes": ["cpe:2.3:o:asus:rt-ax88u_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.0.0.4.388_24209", "versionType": "custom"}]}, {"vendor": "asus", "product": "rt-ax57_firmware", "cpes": ["cpe:2.3:o:asus:rt-ax57_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.0.0.4.386_52294", "versionType": "custom"}]}, {"vendor": "asus", "product": "rt-ac86u_firmware", "cpes": ["cpe:2.3:o:asus:rt-ac86u_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.0.0.4.386_51915", "versionType": "custom"}]}, {"vendor": "asus", "product": "rt-ac68u_firmware", "cpes": ["cpe:2.3:o:asus:rt-ac68u_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.0.0.4.386_51668", "versionType": "custom"}]}, {"vendor": "asus", "product": "zenwifi_xt8_firmware", "cpes": ["cpe:2.3:o:asus:zenwifi_xt8_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.0.0.4.388_24609", "versionType": "custom"}]}, {"vendor": "asus", "product": "zenwifi_xt8_v2_firmware", "cpes": ["cpe:2.3:o:asus:zenwifi_xt8_v2_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.0.0.4.388_24609", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-27T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2024-3079"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-28T03:55:20.013Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:32:42.604Z"}, "title": "CVE Program Container", "references": [{"tags": ["third-party-advisory", "x_transferred"], "url": "https://www.twcert.org.tw/tw/cp-132-7857-5726f-1.html"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://www.twcert.org.tw/en/cp-139-7858-3c978-2.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-3079", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-06-14T22:23:24.659189Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:asus:rt-ax58u_firmware:-:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ax58u_firmware", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.388_24762", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:asus:rt-ax88u_firmware:-:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ax88u_firmware", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.388_24209", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:asus:rt-ax57_firmware:-:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ax57_firmware", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_52294", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:asus:rt-ac86u_firmware:-:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ac86u_firmware", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51915", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:asus:rt-ac68u_firmware:-:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ac68u_firmware", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.386_51668", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:asus:zenwifi_xt8_firmware:-:*:*:*:*:*:*:*"], "vendor": "asus", "product": "zenwifi_xt8_firmware", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.388_24609", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:asus:zenwifi_xt8_v2_firmware:-:*:*:*:*:*:*:*"], "vendor": "asus", "product": "zenwifi_xt8_v2_firmware", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0.4.388_24609", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T19:28:30.035Z"}}], "cna": {"title": "ASUS Router - Stack-based Buffer Overflow", "source": {"advisory": "TVN-202406002", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ASUS", "product": "ZenWiFi XT8", "versions": [{"status": "affected", "version": "earlier", "versionType": "custom", "lessThanOrEqual": "3.0.0.4.388_24609"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "ZenWiFi XT8 V2", "versions": [{"status": "affected", "version": "earlier", "versionType": "custom", "lessThanOrEqual": "3.0.0.4.388_24609"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "RT-AX88U", "versions": [{"status": "affected", "version": "earlier", "versionType": "custom", "lessThanOrEqual": "3.0.0.4.388_24198"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "RT-AX58U", "versions": [{"status": "affected", "version": "earlier", "versionType": "custom", "lessThanOrEqual": "3.0.0.4.388_23925"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "RT-AX57", "versions": [{"status": "affected", "version": "earlier", "versionType": "custom", "lessThanOrEqual": "3.0.0.4.386_52294"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "RT-AC86U", "versions": [{"status": "affected", "version": "earlier", "versionType": "custom", "lessThanOrEqual": "3.0.0.4.386_51915"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "RT-AC68U", "versions": [{"status": "affected", "version": "earlier", "versionType": "custom", "lessThanOrEqual": "3.0.0.4.386_51668"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update ZenWiFi XT8 to version 3.0.0.4.388_24621 or later\nUpdate ZenWiFi XT8 V2 to version 3.0.0.4.388_24621 or later\nUpdate RT-AX88U to version 3.0.0.4.388_24209 or later\nUpdate RT-AX58U to version 3.0.0.4.388_24762 or later\nUpdate RT-AX57 to version 3.0.0.4.386_52303 or later\nUpdate RT-AC86U to version 3.0.0.4.386_51925 or later\nUpdate RT-AC68U to version 3.0.0.4.386_51685 or later", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Update ZenWiFi XT8 to version 3.0.0.4.388_24621 or later</span><br><span style=\"background-color: rgb(255, 255, 255);\">Update ZenWiFi XT8 V2 to version 3.0.0.4.388_24621 or later</span><br><span style=\"background-color: rgb(255, 255, 255);\">Update RT-AX88U to version 3.0.0.4.388_24209 or later</span><br><span style=\"background-color: rgb(255, 255, 255);\">Update RT-AX58U to version 3.0.0.4.388_24762 or later</span><br><span style=\"background-color: rgb(255, 255, 255);\">Update RT-AX57 to version 3.0.0.4.386_52303 or later</span><br><span style=\"background-color: rgb(255, 255, 255);\">Update RT-AC86U to version 3.0.0.4.386_51925 or later</span><br><span style=\"background-color: rgb(255, 255, 255);\">Update RT-AC68U to version 3.0.0.4.386_51685 or later</span>\n\n<br>", "base64": false}]}], "datePublic": "2024-06-14T02:22:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7857-5726f-1.html", "tags": ["third-party-advisory"]}, {"url": "https://www.twcert.org.tw/en/cp-139-7858-3c978-2.html", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Certain models of ASUS routers have buffer overflow vulnerabilities, allowing remote attackers with administrative privileges to execute arbitrary commands on the device.", "supportingMedia": [{"type": "text/html", "value": "Certain models of ASUS routers have buffer overflow vulnerabilities, allowing remote attackers with administrative privileges to execute arbitrary commands on the device.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121: Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-06-14T02:59:31.013Z"}}}, "cveMetadata": {"cveId": "CVE-2024-3079", "state": "PUBLISHED", "dateUpdated": "2024-06-28T03:55:20.013Z", "dateReserved": "2024-03-29T07:18:04.796Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2024-06-14T02:32:21.718Z", "assignerShortName": "twcert"}, "dataVersion": "5.1"}