PT-2024-4602 · Asus · Asus Rt-N12+ B1

Published 2024-03-08 · Updated 2024-12-28 · CVE-2024-28326

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: ASUS RT-N12+ B1 versions (affected versions not specified) ASUS RT-N12 D1 versions (affected versions not specified)

Description: The issue is related to insufficient access control in the UART interface of the firmware of ASUS routers, allowing local attackers to gain unauthorized access to the root terminal. This can be exploited through the UART interface, potentially giving attackers root access to the device.

Recommendations: For ASUS RT-N12+ B1, restrict access to the UART interface until a patch is available. For ASUS RT-N12 D1, restrict access to the UART interface until a patch is available. As a temporary workaround, consider disabling the UART interface on both models to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

CWE-1263

Related Identifiers

BDU:2024-05110

CVE-2024-28326

Affected Products

Asus Rt-N12+ B1

References · 11

• 🔥❌ https://github.com/ShravanSinghRathore/ASUS-RT-N300-B1/wiki/Privilege-Escalation-CVE%E2%80%902024%E2%80%9028326 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2024-28326 · Security Note
• https://bdu.fstec.ru/vul/2024-05110 · Security Note
• https://vuldb.com/ru/?id.262200 · Note
• https://t.me/cvenotify/78376 · Telegram Post
• https://incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2024-28326 · Note
• https://twitter.com/HardBreakWiki/status/1873043401362554942 · Twitter Post
• https://t.me/cvenotify/104470 · Telegram Post
• https://twitter.com/CVEnew/status/1783940141960122777 · Twitter Post
• https://t.me/cvenotify/78209 · Telegram Post
• http://asus.com · Note