ASUS Router - Stack-based Buffer Overflow
Priority LOW 35CWE-121Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
Certain models of ASUS routers have buffer overflow vulnerabilities, allowing remote attackers with administrative privileges to execute arbitrary commands on the device.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00826 57th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ASUS | ZenWiFi XT8 | earlier – 3.0.0.4.388_24609 | — | No fix listed | CNA |
| ASUS | ZenWiFi XT8 V2 | earlier – 3.0.0.4.388_24609 | — | No fix listed | CNA |
| ASUS | RT-AX88U | earlier – 3.0.0.4.388_24198 | — | No fix listed | CNA |
| ASUS | RT-AX58U | earlier – 3.0.0.4.388_23925 | — | No fix listed | CNA |
| ASUS | RT-AX57 | earlier – 3.0.0.4.386_52294 | — | No fix listed | CNA |
| ASUS | RT-AC86U | earlier – 3.0.0.4.386_51915 | — | No fix listed | CNA |
| ASUS | RT-AC68U | earlier – 3.0.0.4.386_51668 | — | No fix listed | CNA |
- ZenWiFi XT8 VendorASUS Affected earlier – 3.0.0.4.388_24609 Fixed in — No fix listed CNA
- ZenWiFi XT8 V2 VendorASUS Affected earlier – 3.0.0.4.388_24609 Fixed in — No fix listed CNA
- RT-AX88U VendorASUS Affected earlier – 3.0.0.4.388_24198 Fixed in — No fix listed CNA
- RT-AX58U VendorASUS Affected earlier – 3.0.0.4.388_23925 Fixed in — No fix listed CNA
- RT-AX57 VendorASUS Affected earlier – 3.0.0.4.386_52294 Fixed in — No fix listed CNA
- RT-AC86U VendorASUS Affected earlier – 3.0.0.4.386_51915 Fixed in — No fix listed CNA
- RT-AC68U VendorASUS Affected earlier – 3.0.0.4.386_51668 Fixed in — No fix listed CNA
CPE names CISA-ADP · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:asus:rt-ax58u_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:rt-ax88u_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:rt-ax57_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:rt-ac86u_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:rt-ac68u_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:zenwifi_xt8_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:zenwifi_xt8_v2_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
- cpe:2.3:o:asus:rt-ax58u_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:rt-ax88u_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:rt-ax57_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:rt-ac86u_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:rt-ac68u_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:zenwifi_xt8_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:zenwifi_xt8_v2_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-3079
- 2026-10-03 Alias added: GHSA-95j6-2grv-6h9g
References
More ASUS vulnerabilities
- TI-2021-12008 The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-36933 "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were… KEVCVSS 4.0CRITICAL 9.3
- TI-2023-20780 OS command injection in ASUS RT-AX55 KEVCVSS 3.1HIGH 8.8
- TI-2018-04367 An issue was discovered in AsusWRT before 3.0.0.4.384_10007. CVSS 3.0CRITICAL 9.8
- TI-2018-04368 An issue was discovered in AsusWRT before 3.0.0.4.384_10007. CVSS 3.0CRITICAL 9.8
- TI-2014-07780 common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and… CVSS 2.0HIGH 10.0
Sources
- CVE-2024-3079 · CVE Program
- CVE-2024-3079 · NVD
- FIRST EPSS
- GHSA-95j6-2grv-6h9g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences