Exploitation Summary
EIP tracks 1 public exploit for CVE-2024-3912. PoCs published by H4rk3nz0.
AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2024-3912, targeting Asus routers. The exploit leverages a two-stage attack: first, it writes a shell script to a temporary file via SETROOTCERTIFICATE, then triggers execution via RC_SERVICE backtick injection in the APPLYAPP endpoint.
Description
Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands on the device.
Exploits (1)
This repository contains a functional exploit PoC for CVE-2024-3912, targeting Asus routers. The exploit leverages a two-stage attack: first, it writes a shell script to a temporary file via SETROOTCERTIFICATE, then triggers execution via RC_SERVICE backtick injection in the APPLYAPP endpoint.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H