CVE-2024-13062 (GCVE-0-2024-13062)

Vulnerability from cvelistv5 – Published: 2025-01-02 09:09 – Updated: 2025-01-06 20:32
VLAI?
Summary
An unintended entry point vulnerability has been identified in certain router models, which may allow for arbitrary command execution. Refer to the ' 01/02/2025 ASUS Router AiCloud vulnerability' section on the ASUS Security Advisory for more information.
Severity ?
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-912 - Hidden Functionality
  • CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
Vendor Product Version
ASUS Router Affected: 3.0.0.4_382 series (custom)
Affected: 3.0.0.4_386 series (custom)
Affected: 3.0.0.4_388 series (custom)
Affected: 3.0.0.6_102 series (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-13062",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-06T20:32:32.491358Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-06T20:32:58.212Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Router",
          "vendor": "ASUS",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0.4_382 series",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "3.0.0.4_386 series",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "3.0.0.4_388 series",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "3.0.0.6_102 series",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An unintended entry point vulnerability has been identified in certain router models, which may allow for arbitrary command execution.\u003cbr\u003eRefer to the \u0027\u0026nbsp;01/02/2025 ASUS Router AiCloud vulnerability\u0027 section on the ASUS Security Advisory for more information."
            }
          ],
          "value": "An unintended entry point vulnerability has been identified in certain router models, which may allow for arbitrary command execution.\nRefer to the \u0027\u00a001/02/2025 ASUS Router AiCloud vulnerability\u0027 section on the ASUS Security Advisory for more information."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-912",
              "description": "CWE-912: Hidden Functionality",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-02T09:09:45.871Z",
        "orgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1",
        "shortName": "ASUS"
      },
      "references": [
        {
          "url": "https://www.asus.com/content/asus-product-security-advisory/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1",
    "assignerShortName": "ASUS",
    "cveId": "CVE-2024-13062",
    "datePublished": "2025-01-02T09:09:45.871Z",
    "dateReserved": "2024-12-31T01:39:32.126Z",
    "dateUpdated": "2025-01-06T20:32:58.212Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"An unintended entry point vulnerability has been identified in certain router models, which may allow for arbitrary command execution.\\nRefer to the \u0027\\u00a001/02/2025 ASUS Router AiCloud vulnerability\u0027 section on the ASUS Security Advisory for more information.\"}, {\"lang\": \"es\", \"value\": \"Se ha identificado una vulnerabilidad de punto de entrada no intencionado en ciertos modelos de routers, que puede permitir la ejecuci\\u00f3n de comandos arbitrarios. Consulte la secci\\u00f3n \\\"Vulnerabilidad de ASUS Router AiCloud del 01/02/2025\\\" en el Aviso de seguridad de ASUS para obtener m\\u00e1s informaci\\u00f3n.\"}]",
      "id": "CVE-2024-13062",
      "lastModified": "2025-01-02T10:15:06.153",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"54bf65a7-a193-42d2-b1ba-8e150d3c35e1\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.2, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 5.9}]}",
      "published": "2025-01-02T10:15:06.153",
      "references": "[{\"url\": \"https://www.asus.com/content/asus-product-security-advisory/\", \"source\": \"54bf65a7-a193-42d2-b1ba-8e150d3c35e1\"}]",
      "sourceIdentifier": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"54bf65a7-a193-42d2-b1ba-8e150d3c35e1\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-77\"}, {\"lang\": \"en\", \"value\": \"CWE-912\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-13062\",\"sourceIdentifier\":\"54bf65a7-a193-42d2-b1ba-8e150d3c35e1\",\"published\":\"2025-01-02T10:15:06.153\",\"lastModified\":\"2025-01-02T10:15:06.153\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An unintended entry point vulnerability has been identified in certain router models, which may allow for arbitrary command execution.\\nRefer to the \u0027\u00a001/02/2025 ASUS Router AiCloud vulnerability\u0027 section on the ASUS Security Advisory for more information.\"},{\"lang\":\"es\",\"value\":\"Se ha identificado una vulnerabilidad de punto de entrada no intencionado en ciertos modelos de routers, que puede permitir la ejecuci\u00f3n de comandos arbitrarios. Consulte la secci\u00f3n \\\"Vulnerabilidad de ASUS Router AiCloud del 01/02/2025\\\" en el Aviso de seguridad de ASUS para obtener m\u00e1s informaci\u00f3n.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"54bf65a7-a193-42d2-b1ba-8e150d3c35e1\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"54bf65a7-a193-42d2-b1ba-8e150d3c35e1\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-77\"},{\"lang\":\"en\",\"value\":\"CWE-912\"}]}],\"references\":[{\"url\":\"https://www.asus.com/content/asus-product-security-advisory/\",\"source\":\"54bf65a7-a193-42d2-b1ba-8e150d3c35e1\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-13062\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-06T20:32:32.491358Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-06T20:32:54.457Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"ASUS\", \"product\": \"Router\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.0.0.4_382 series\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.0.0.4_386 series\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.0.0.4_388 series\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.0.0.6_102 series\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.asus.com/content/asus-product-security-advisory/\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An unintended entry point vulnerability has been identified in certain router models, which may allow for arbitrary command execution.\\nRefer to the \u0027\\u00a001/02/2025 ASUS Router AiCloud vulnerability\u0027 section on the ASUS Security Advisory for more information.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"An unintended entry point vulnerability has been identified in certain router models, which may allow for arbitrary command execution.\u003cbr\u003eRefer to the \u0027\u0026nbsp;01/02/2025 ASUS Router AiCloud vulnerability\u0027 section on the ASUS Security Advisory for more information.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-912\", \"description\": \"CWE-912: Hidden Functionality\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-77\", \"description\": \"CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"54bf65a7-a193-42d2-b1ba-8e150d3c35e1\", \"shortName\": \"ASUS\", \"dateUpdated\": \"2025-01-02T09:09:45.871Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-13062\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-01-06T20:32:58.212Z\", \"dateReserved\": \"2024-12-31T01:39:32.126Z\", \"assignerOrgId\": \"54bf65a7-a193-42d2-b1ba-8e150d3c35e1\", \"datePublished\": \"2025-01-02T09:09:45.871Z\", \"assignerShortName\": \"ASUS\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.