CVE-2024-31162

HIGH

ASUS Download Master < 3.1.0.113 - Unauthenticated OS Command Injection

Title source: llm
STIX 2.1

Description

The specific function parameter of ASUS Download Master does not properly filter user input. An unauthenticated remote attacker with administrative privileges can exploit this vulnerability to execute arbitrary system commands on the device.

References (2)

Core 2
Core References
Various Sources third-party-advisory
https://www.twcert.org.tw/tw/cp-132-7867-8fad9-1.html
Various Sources third-party-advisory
https://www.twcert.org.tw/en/cp-139-7868-8a760-2.html

Scores

CVSS v3 7.2
EPSS 0.0141
EPSS Percentile 80.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (1)
ASUS/Download Master earlier - 3.1.0.113
Published Jun 14, 2024
Tracked Since Feb 18, 2026