CVE-2024-3079 - OpenCVE

Certain models of ASUS routers have buffer overflow vulnerabilities, allowing remote attackers with administrative privileges to execute arbitrary commands on the device.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

No data.

No data.

References

Link	Resource
https://www.twcert.org.tw/en/cp-139-7858-3c978-2.html
https://www.twcert.org.tw/tw/cp-132-7857-5726f-1.html

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: twcert

Published: 2024-06-14T02:32:21.718Z

Updated: 2024-06-28T03:55:20.013Z

Reserved: 2024-03-29T07:18:04.796Z

Link: CVE-2024-3079

JSON object: View

NVD Information

Status : Awaiting Analysis

Published: 2024-06-14T03:15:13.540

Modified: 2024-06-17T12:43:31.090

Link: CVE-2024-3079

JSON object: View

Redhat Information

No data.

CWE

CWE-121

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-3079", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2024-03-29T07:18:04.796Z", "datePublished": "2024-06-14T02:32:21.718Z", "dateUpdated": "2024-06-28T03:55:20.013Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ZenWiFi XT8", "vendor": "ASUS", "versions": [{"lessThanOrEqual": "3.0.0.4.388_24609", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "ZenWiFi XT8 V2", "vendor": "ASUS", "versions": [{"lessThanOrEqual": "3.0.0.4.388_24609", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RT-AX88U", "vendor": "ASUS", "versions": [{"lessThanOrEqual": "3.0.0.4.388_24198", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RT-AX58U", "vendor": "ASUS", "versions": [{"lessThanOrEqual": "3.0.0.4.388_23925", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RT-AX57", "vendor": "ASUS", "versions": [{"lessThanOrEqual": "3.0.0.4.386_52294", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RT-AC86U", "vendor": "ASUS", "versions": [{"lessThanOrEqual": "3.0.0.4.386_51915", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RT-AC68U", "vendor": "ASUS", "versions": [{"lessThanOrEqual": "3.0.0.4.386_51668", "status": "affected", "version": "earlier", "versionType": "custom"}]}], "datePublic": "2024-06-14T02:22:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Certain models of ASUS routers have buffer overflow vulnerabilities, allowing remote attackers with administrative privileges to execute arbitrary commands on the device."}], "value": "Certain models of ASUS routers have buffer overflow vulnerabilities, allowing remote attackers with administrative privileges to execute arbitrary commands on the device."}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "description": "CWE-121: Stack-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-06-14T02:59:31.013Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-7857-5726f-1.html"}, {"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/en/cp-139-7858-3c978-2.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Update ZenWiFi XT8 to version 3.0.0.4.388_24621 or later</span><br><span style=\"background-color: rgb(255, 255, 255);\">Update ZenWiFi XT8 V2 to version 3.0.0.4.388_24621 or later</span><br><span style=\"background-color: rgb(255, 255, 255);\">Update RT-AX88U to version 3.0.0.4.388_24209 or later</span><br><span style=\"background-color: rgb(255, 255, 255);\">Update RT-AX58U to version 3.0.0.4.388_24762 or later</span><br><span style=\"background-color: rgb(255, 255, 255);\">Update RT-AX57 to version 3.0.0.4.386_52303 or later</span><br><span style=\"background-color: rgb(255, 255, 255);\">Update RT-AC86U to version 3.0.0.4.386_51925 or later</span><br><span style=\"background-color: rgb(255, 255, 255);\">Update RT-AC68U to version 3.0.0.4.386_51685 or later</span>\n\n<br>"}], "value": "Update ZenWiFi XT8 to version 3.0.0.4.388_24621 or later\nUpdate ZenWiFi XT8 V2 to version 3.0.0.4.388_24621 or later\nUpdate RT-AX88U to version 3.0.0.4.388_24209 or later\nUpdate RT-AX58U to version 3.0.0.4.388_24762 or later\nUpdate RT-AX57 to version 3.0.0.4.386_52303 or later\nUpdate RT-AC86U to version 3.0.0.4.386_51925 or later\nUpdate RT-AC68U to version 3.0.0.4.386_51685 or later"}], "source": {"advisory": "TVN-202406002", "discovery": "EXTERNAL"}, "title": "ASUS Router - Stack-based Buffer Overflow", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "asus", "product": "rt-ax58u_firmware", "cpes": ["cpe:2.3:o:asus:rt-ax58u_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.0.0.4.388_24762", "versionType": "custom"}]}, {"vendor": "asus", "product": "rt-ax88u_firmware", "cpes": ["cpe:2.3:o:asus:rt-ax88u_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.0.0.4.388_24209", "versionType": "custom"}]}, {"vendor": "asus", "product": "rt-ax57_firmware", "cpes": ["cpe:2.3:o:asus:rt-ax57_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.0.0.4.386_52294", "versionType": "custom"}]}, {"vendor": "asus", "product": "rt-ac86u_firmware", "cpes": ["cpe:2.3:o:asus:rt-ac86u_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.0.0.4.386_51915", "versionType": "custom"}]}, {"vendor": "asus", "product": "rt-ac68u_firmware", "cpes": ["cpe:2.3:o:asus:rt-ac68u_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.0.0.4.386_51668", "versionType": "custom"}]}, {"vendor": "asus", "product": "zenwifi_xt8_firmware", "cpes": ["cpe:2.3:o:asus:zenwifi_xt8_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.0.0.4.388_24609", "versionType": "custom"}]}, {"vendor": "asus", "product": "zenwifi_xt8_v2_firmware", "cpes": ["cpe:2.3:o:asus:zenwifi_xt8_v2_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.0.0.4.388_24609", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-27T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2024-3079"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-28T03:55:20.013Z"}}]}}