CVE-2024-3912: ASUS Router - Upload arbitrary firmware

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-14 · updated 2026-06-17
Weakness: CWE-434

Description

Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands on the device.

Affected products

ASUS Dsl-Ac56U Firmware: before 1.1.2.3_999 — fixed in 1.1.2.3_999
ASUS DSL-N14U_B1: before 1.1.2.3_807 — fixed in 1.1.2.3_807
ASUS Dsl-N16P Firmware: all versions
ASUS Dsl-N55U D1 Firmware: before 1.1.2.3_792 — fixed in 1.1.2.3_792

How to fix

Upgrade to a fixed version: ASUS Dsl-Ac56U Firmware 1.1.2.3_999; ASUS DSL-N14U_B1 1.1.2.3_807; ASUS Dsl-N55U D1 Firmware 1.1.2.3_792. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-3912 or the next vulnerability affects your stack