PT-2024-5045 · Asus · Asus Routers

Published

2024-06-13

·

Updated

2026-03-10

·

CVE-2024-3080

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions: ASUS router models (affected versions not specified)
Description: The issue is related to an authentication bypass vulnerability in certain ASUS router models, allowing unauthenticated remote attackers to log in to the device. This vulnerability has been exploited in real-world incidents, including a record-breaking 3.8 Tbps DDoS attack that lasted 65 seconds. The attack was likely caused by a botnet of infected ASUS routers. It is estimated that over 147,000 ASUS routers are potentially vulnerable due to this issue. The vulnerability is associated with deficiencies in the authentication procedure.
Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2024-05572
CVE-2024-3080

Affected Products

Asus Routers