CVE-2024-1655: ASUS WiFi Router - OS Command Injection

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-15 · updated 2026-06-17
Weakness: CWE-78

Description

Certain ASUS WiFi routers models has an OS Command Injection vulnerability, allowing an authenticated remote attacker to execute arbitrary system commands by sending a specially crafted request.

Affected products

ASUS ExpertWiFi EBM63: before 3.0.0.6.102_32645 — fixed in 3.0.0.6.102_32645
ASUS ExpertWiFi EBM68: before 3.0.0.6.102_44384 — fixed in 3.0.0.6.102_44384
ASUS RT-AX57 Go: before 3.0.0.6.102_22188 — fixed in 3.0.0.6.102_22188

How to fix

Upgrade to a fixed version: ASUS ExpertWiFi EBM63 3.0.0.6.102_32645; ASUS ExpertWiFi EBM68 3.0.0.6.102_44384; ASUS RT-AX57 Go 3.0.0.6.102_22188. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-1655 or the next vulnerability affects your stack