Cyber Security News

ASUS Critical Vulnerabilities Let Attackers Execute Arbitrary Commands

In a recent security advisory, ASUS has alerted users to critical vulnerabilities affecting several of its router models. 

These flaws, tracked as CVE-2024-12912 and CVE-2024-13062, pose severe risks by allowing attackers to execute arbitrary commands on compromised devices. ASUS has advised users to act immediately by updating their routers to stay protected.

About the Vulnerabilities

The two vulnerabilities are linked to the router firmware’s AiCloud feature. According to ASUS, these “injection and execution vulnerabilities” can allow authenticated attackers to trigger remote command execution.

Both flaws have been assigned a CVSS (Common Vulnerability Scoring System) score of 7.2, categorizing them as high severity.

CVE Details:

  1. CVE-2024-12912: This vulnerability exploits a lack of validation in the AiCloud service, enabling attackers to execute arbitrary commands.
  2. CVE-2024-13062: This allows a similarly dangerous attack vector through improperly sanitized input.

Users of vulnerable ASUS router models are at risk if these flaws are left unpatched.

To address these vulnerabilities, ASUS has urged users to quickly update their router firmware. The latest versions—3.0.0.4_386, 3.0.0.4_388, or 3.0.0.6_102 series—contain fixes that mitigate the risks.

For users who cannot immediately apply the updates, ASUS recommends the following mitigation practices:

  • Use Strong Passwords: Set unique, complex passwords for both your wireless network and router administration page. Passwords should include at least 10 characters with a mix of numbers, symbols, and uppercase/lowercase letters.
  • Enable AiCloud Password Protection: Ensure password protection is enabled within the AiCloud service to prevent unauthorized access.
  • Disable External Services: Turn off internet-facing features like remote access, port forwarding, DDNS, VPN server, DMZ, and FTP when not in use.

This advisory emphasizes the critical importance of regularly updating router firmware and following strong security practices.

ASUS advises customers to frequently check their device settings and ensure all features are configured securely. The company encourages users to report any product-related security concerns through its dedicated vulnerability disclosure page.

Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN – Try for Free

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

Ivanti Released Security Updates to Fix for the Mutiple RCE Vulnerabilities – Patch Now

Ivanti, a leading enterprise software provider, has released critical security updates addressing vulnerabilities across several…

56 minutes ago

Fortinet FortiVoice Zero-day Vulnerability Actively Exploited in The Wild

A critical stack-based buffer overflow vulnerability (CWE-121) has been discovered in multiple Fortinet products, including…

1 hour ago

Ransomware Attacks Surge by 123% Amid Evolving Tactics and Strategies

The 2025 Third-Party Breach Report from Black Kite highlights a staggering 123% surge in ransomware…

2 hours ago

Researchers Introduce Mythic Framework Agent to Enhance Pentesting Tool Performance

Penetration testing is still essential for upholding strong security procedures in a time when cybersecurity…

2 hours ago

Swan Vector APT Targets Organizations with Malicious LNK and DLL Implants

A newly identified advanced persistent threat (APT) campaign, dubbed "Swan Vector" by Seqrite Labs, has…

2 hours ago

Hackers Weaponize KeePass Password Manager to Spread Malware and Steal Passwords

Threat actors have successfully exploited the widely-used open-source password manager, KeePass, to spread malware and…

2 hours ago