PT-2024-4605 · Asus · Asus Rt-N12+ B1

Published 2024-04-26 · Updated 2024-07-03 · CVE-2024-28328

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: ASUS RT-N12+ B1 version (affected versions not specified)

Description: The issue is related to a lack of data sanitization on the administrative level, allowing for the exploitation of a CSV injection vulnerability. This vulnerability enables a remote attacker to execute arbitrary commands by injecting malicious input through the client name parameter. The vulnerability can be triggered when exporting data to CSV format, potentially allowing the execution of injected commands or formulas in a different user session.

Recommendations: As a temporary workaround, consider restricting access to the client name parameter to minimize the risk of exploitation. Avoid using the client name parameter in the affected router until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-05113

CVE-2024-28328

Affected Products

Asus Rt-N12+ B1

References · 9

• 🔥❌ https://github.com/ShravanSinghRathore/ASUS-RT-N300-B1/wiki/CSV-Injection-CVE%E2%80%902024%E2%80%9028328 · Exploit, Deleted
• 🔥❌ https://github.com/ShravanSinghRathore/ASUS-RT-N300-B1/wiki/Credentials-Stored-in-Cleartext-CVE%E2%80%902024%E2%80%9028328 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2024-28328 · Security Note
• https://bdu.fstec.ru/vul/2024-05113 · Security Note
• https://twitter.com/CVEnew/status/1783883464237781111 · Twitter Post
• http://asus.com · Note
• https://incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2024-28328 · Note
• https://twitter.com/VulmonFeeds/status/1783898883359158565 · Twitter Post
• https://redfoxsec.com/blog/asus-rt-n12-b1s-csv-injection-cve%E2%80%902024%E2%80%9028328 · Note