External risk intelligence

ASUS Router Firmware Upload Vulnerability Allows Remote Command Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-3912

The vulnerability affects ASUS routers and allows for unauthenticated remote command execution. Routers are edge devices commonly deployed to face the public internet, and administrative interfaces or firmware upload mechanisms on these devices are frequently exposed to the network edge in standard deployment scenarios.

Unrestricted File Upload

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in certain ASUS routers that could allow an unauthenticated remote attacker to execute arbitrary system commands. The issue involves an arbitrary firmware upload capability, posing a significant risk if exploited due to the direct control it could grant over the affected network devices.

Routers could be compromised remotely.
This allows attackers to run any command.
Confirm relevance and exposure of affected devices.

Attack Path

How an attacker could exploit the issue

An attacker could begin by finding an exposed ASUS router on the internet. Without needing any login credentials, they could then upload a modified firmware image, which would allow them to execute commands on the router's system. This could potentially lead to full control of the affected device.

No authentication required.
Uploading malicious firmware.
Complete system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to upload arbitrary firmware, potentially leading to the execution of system commands on affected ASUS routers. This exposure could happen when the device's firmware update mechanism is accessible over the network.

Router firmware and system commands at risk.
Malicious firmware upload via network access.
Unauthorized system control and potential disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The critical arbitrary firmware upload vulnerability in certain ASUS routers requires immediate attention from network and security teams, as well as potentially infrastructure or platform teams responsible for device management. The first practical step is to identify all ASUS routers within the environment, confirm their exposure to the internet or untrusted networks, and determine their business criticality. Once identified, the accountable owner should be located to plan and execute remediation, which may involve coordinated vendor support or temporary risk reduction measures.

Network and security teams own the issue.
Verify router exposure and criticality first.
Plan coordinated vendor-assisted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the role of ASUS routers in a home or business network?

ASUS routers serve as the primary gateway between a local network and the internet. They manage data traffic, enforce firewall rules, and provide wireless connectivity. Because they sit at the network edge and contain specialized firmware to handle routing protocols and hardware interfaces, they act as the gatekeepers for all devices connected to them.

How does this CVE-2024-3912 vulnerability work?

This issue is classified as Unrestricted Upload of File with Dangerous Type (CWE-434). It means the router fails to properly validate files sent to the firmware update mechanism. Because the device treats a malicious file as legitimate firmware, an attacker can replace the system software with their own, allowing them to run unauthorized commands with full control over the router.

Do I need to be logged into the router to trigger this bug?

No. The vulnerability does not require any credentials or administrative access to the router's interface to be triggered. If the firmware upload mechanism is reachable, an attacker can initiate the process remotely. The flaw is not triggered by normal traffic passing through the router, but specifically by interacting with the administrative firmware update feature.

Why is this CVE-2024-3912 dangerous for my internet-facing devices?

According to Halo Surface Signal, this is highly relevant because routers are typically deployed to face the public internet. Since the vulnerability allows unauthenticated access, any ASUS router with an exposed administration or update portal is directly reachable by global attackers, making it much easier for them to discover and compromise the device.

How should I respond if I use affected ASUS hardware?

Start by identifying all ASUS routers in your environment and verifying if their management interfaces are accessible from the internet. Prioritize devices that are exposed to untrusted networks. Once you have an inventory, determine the business criticality of each router and coordinate with your internal teams or the vendor to plan updates or apply temporary access restrictions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.