CVE-2024-1655

CVE-2024-1655 描述 ASUS ExpertWiFi EBM63、EBM68 和 RT-AX57 Go 固件在 2024-12-04 补丁之前，splashpageSDN.cgi 函数中存在命令注入漏洞。当攻击者发送特制请求时，可以实现任意代码执行。 参考资料： 官方报告 用法 该漏洞是经过身份验证的远程代码执行，使用此脚本的用户需要首先获取目标的登录令牌（Cookie 头中 asustoken 的值）。 root@kitploit: $ python3 CVE-2024-1655.py --host --token 示例：在 tmp 目录中创建文件 root@kitploi...

CVE-2024-0401

CVE-2024-0401 affects multiple ASUS routers that support custom OpenVPN profiles. An authenticated, remote attacker can execute arbitrary OS commands by uploading a crafted OVPN profile, with impact on confidentiality, integrity, and availability per the cited sources. Affected models include: AS...

CVE-2024-0401 ASUS OVPN RCE

ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS ExpertWiFi, ASUS RT-AX55, ASUS RT-AX58U,...

ASUS WiFi routers 操作系统命令注入漏洞

ASUS WiFi routers are a series of routers from the Chinese company Asus ASUS. The ASUS WiFi routers have an operating system command injection vulnerability that stems from the presence of an operating system command injection vulnerability. An attacker can exploit the vulnerability to execute...