CVE-2024-31161: ASUS Download Master - Arbitrary File Upload

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-14 · updated 2026-06-17
Weakness: CWE-434

Description

The upload functionality of ASUS Download Master does not properly filter user input. Remote attackers with administrative privilege can exploit this vulnerability to upload any file to any location. They may even upload malicious web page files to the website directory, allowing arbitrary system commands to be executed upon browsing the webpage.

Affected products

ASUS Download Master: before 3.1.0.114 — fixed in 3.1.0.114

How to fix

Upgrade to a fixed version: ASUS Download Master 3.1.0.114. Check the vendor advisory for mitigations.

References

https://www.twcert.org.tw/en/cp-139-7866-469e0-2.html
https://www.twcert.org.tw/tw/cp-132-7865-d3823-1.html
https://www.twcert.org.tw/en/cp-139-7866-469e0-2.html
https://www.twcert.org.tw/tw/cp-132-7865-d3823-1.html

Get alerted when CVE-2024-31161 or the next vulnerability affects your stack