CVE-2024-3080: ASUS Router - Improper Authentication

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 43.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-06-14 · updated 2026-06-17
Weakness: CWE-287

Description

Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in the device.

Affected products

ASUS Japan Inc. RT-AC68U: before 3.0.0.4.386_51668 — fixed in 3.0.0.4.386_51668
ASUS RT-AC86U: before 3.0.0.4.386_51915 — fixed in 3.0.0.4.386_51915
ASUS Rt-Ax57 Firmware: before 3.0.0.4.386_52294 — fixed in 3.0.0.4.386_52294
ASUS Rt-Ax58U Firmware: before 3.0.0.4.388_24762 — fixed in 3.0.0.4.388_24762
ASUS RT-AX88U: before 3.0.0.4.388_24209 — fixed in 3.0.0.4.388_24209
ASUS Zenwifi Xt8 Firmware: before 3.0.0.4.388_24609 — fixed in 3.0.0.4.388_24609
ASUS Zenwifi Xt8 V2 Firmware: before 3.0.0.4.388_24609 — fixed in 3.0.0.4.388_24609

How to fix

Upgrade to a fixed version: ASUS Japan Inc. RT-AC68U 3.0.0.4.386_51668; ASUS RT-AC86U 3.0.0.4.386_51915; ASUS Rt-Ax57 Firmware 3.0.0.4.386_52294; ASUS Rt-Ax58U Firmware 3.0.0.4.388_24762; ASUS RT-AX88U 3.0.0.4.388_24209; ASUS Zenwifi Xt8 Firmware 3.0.0.4.388_24609; ASUS Zenwifi Xt8 V2 Firmware 3.0.0.4.388_24609. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-3080 or the next vulnerability affects your stack