CVE-2024-31161

HIGH

Asus Download Master < 3.1.0.114 - Unrestricted File Upload

Title source: rule
STIX 2.1

Description

The upload functionality of ASUS Download Master does not properly filter user input. Remote attackers with administrative privilege can exploit this vulnerability to upload any file to any location. They may even upload malicious web page files to the website directory, allowing arbitrary system commands to be executed upon browsing the webpage.

References (2)

Core 2
Core References
Third Party Advisory third-party-advisory
https://www.twcert.org.tw/tw/cp-132-7865-d3823-1.html
Third Party Advisory third-party-advisory
https://www.twcert.org.tw/en/cp-139-7866-469e0-2.html

Scores

CVSS v3 7.2
EPSS 0.0105
EPSS Percentile 77.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-434
Status published
Products (1)
asus/download_master < 3.1.0.114
Published Jun 14, 2024
Tracked Since Feb 18, 2026