Article Details
Scrape Timestamp (UTC): 2024-06-15 15:18:42.451
Original Article Text
Click to Toggle View
ASUS warns of critical remote authentication bypass on 7 routers. ASUS has released a new firmware update that addresses a vulnerability impacting seven router models that allow remote attackers to log in to devices. The flaw, tracked as CVE-2024-3080 (CVSS v3.1 score: 9.8 “critical”), is an authentication bypass vulnerability allowing unauthenticated, remote attackers to take control of the device. ASUS says the issue impacts the following router models: ASUS suggests that people update their devices to the latest firmware versions available on its download portals (links for each model above). Firmware update instructions are available on this FAQ page. For those unable to update the firmware immediately, the vendor suggests they ensure their account and WiFi passwords are strong (over 10 non-consecutive characters long). Moreover, it is recommended to disable internet access to the admin panel, remote access from WAN, port forwarding, DDNS, VPN server, DMZ, and port trigger. One more vulnerability addressed on the same package is CVE-2024-3079, a high-severity (7.2) buffer overflow problem that requires admin account access to exploit. Taiwan's CERT has also informed the public about CVE-2024-3912 in a post yesterday, which is a critical (9.8) arbitrary firmware upload vulnerability allowing unauthenticated, remote attackers to execute system commands on the device. The flaw impacts multiple ASUS router models, but not all will be getting security updates due to them having reached their end-of-life (EoL). The proposed solution per impacted model is: Download Master security updates Finally, ASUS announced an update to Download Master, a utility used on ASUS routers that enables users to manage and download files directly to a connected USB storage device via torrent, HTTP, or FTP. The newly released Download Master version 3.1.0.114 addresses five medium to high-severity issues concerning arbitrary file upload, OS command injection, buffer overflow, reflected XSS, and stored XSS problems. Though none of those is as critical as CVE-2024-3080, it is recommended that users upgrade their utility to version 3.1.0.114 or later for optimal security and protection.
Daily Brief Summary
ASUS has issued a critical firmware update for seven router models due to a severe authentication bypass flaw identified as CVE-2024-3080, with a CVSS score of 9.8.
The vulnerability allows unauthenticated, remote attackers to gain control of affected routers without needing login credentials.
Affected router owners are urged to update their firmware immediately or strengthen their device security settings if immediate update isn't possible.
Recommendations include enforcing strong passwords, disabling internet access to administration panels, and turning off features like port forwarding and VPN server.
The update also fixes another high-severity issue, CVE-2024-3079, a buffer overflow vulnerability that can be exploited with admin access.
Additionally, ASUS responded to CVE-2024-3913, impacting multiple router models with a critical arbitrary firmware upload flaw.
Not all models will receive updates as some have reached end-of-life status, suggesting alternate mitigation options per model.
Alongside the router firmware upgrades, a new version of Download Master for ASUS routers has been released to tackle five less severe, but significant, security threats.