ASUS Router - Upload arbitrary firmware
Priority MEDIUM 45CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands on the device.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01022 63rd percentileScored 2026-11-07
Fix Fixed DSL-N17U (ASUS): 1.1.2.3_792DSL-N55U_C1 (ASUS): 1.1.2.3_792+12 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ASUS | DSL-N17U | earlier to before 1.1.2.3_792 | 1.1.2.3_792 | Patch available | CNA |
| ASUS | DSL-N55U_C1 | earlier to before 1.1.2.3_792 | 1.1.2.3_792 | Patch available | CNA |
| ASUS | DSL-N55U_D1 | earlier to before 1.1.2.3_792 | 1.1.2.3_792 | Patch available | CNA |
| ASUS | DSL-N66U | earlier to before 1.1.2.3_792 | 1.1.2.3_792 | Patch available | CNA |
| ASUS | DSL-N12U_C1 | earlier to before 1.1.2.3_807 | 1.1.2.3_807 | Patch available | CNA |
| ASUS | DSL-N12U_D1 | earlier to before 1.1.2.3_807 | 1.1.2.3_807 | Patch available | CNA |
| ASUS | DSL-N14U | earlier to before 1.1.2.3_807 | 1.1.2.3_807 | Patch available | CNA |
| ASUS | DSL-N14U_B1 | earlier to before 1.1.2.3_807 | 1.1.2.3_807 | Patch available | CNA |
| ASUS | DSL-N16 | earlier to before 1.1.2.3_999 | 1.1.2.3_999 | Patch available | CNA |
| ASUS | DSL-AC51 | earlier to before 1.1.2.3_999 | 1.1.2.3_999 | Patch available | CNA |
| ASUS | DSL-AC750 | earlier to before 1.1.2.3_999 | 1.1.2.3_999 | Patch available | CNA |
| ASUS | DSL-AC52U | earlier to before 1.1.2.3_999 | 1.1.2.3_999 | Patch available | CNA |
| ASUS | DSL-AC55U | earlier to before 1.1.2.3_999 | 1.1.2.3_999 | Patch available | CNA |
| ASUS | DSL-AC56U | earlier to before 1.1.2.3_999 | 1.1.2.3_999 | Patch available | CNA |
| ASUS | DSL-N10_C1 | All | — | No fix listed | CNA |
| ASUS | DSL-N10_D1 | All | — | No fix listed | CNA |
| ASUS | DSL-N10P_C1 | All | — | No fix listed | CNA |
| ASUS | DSL-N12E_C1 | All | — | No fix listed | CNA |
| ASUS | DSL-N16P | All | — | No fix listed | CNA |
| ASUS | DSL-N16U | All | — | No fix listed | CNA |
| ASUS | DSL-AC52 | All | — | No fix listed | CNA |
| ASUS | DSL-AC55 | All | — | No fix listed | CNA |
- DSL-N17U VendorASUS Affected earlier to before 1.1.2.3_792 Fixed in 1.1.2.3_792 Patch available CNA
- DSL-N55U_C1 VendorASUS Affected earlier to before 1.1.2.3_792 Fixed in 1.1.2.3_792 Patch available CNA
- DSL-N55U_D1 VendorASUS Affected earlier to before 1.1.2.3_792 Fixed in 1.1.2.3_792 Patch available CNA
- DSL-N66U VendorASUS Affected earlier to before 1.1.2.3_792 Fixed in 1.1.2.3_792 Patch available CNA
- DSL-N12U_C1 VendorASUS Affected earlier to before 1.1.2.3_807 Fixed in 1.1.2.3_807 Patch available CNA
- DSL-N12U_D1 VendorASUS Affected earlier to before 1.1.2.3_807 Fixed in 1.1.2.3_807 Patch available CNA
- DSL-N14U VendorASUS Affected earlier to before 1.1.2.3_807 Fixed in 1.1.2.3_807 Patch available CNA
- DSL-N14U_B1 VendorASUS Affected earlier to before 1.1.2.3_807 Fixed in 1.1.2.3_807 Patch available CNA
- DSL-N16 VendorASUS Affected earlier to before 1.1.2.3_999 Fixed in 1.1.2.3_999 Patch available CNA
- DSL-AC51 VendorASUS Affected earlier to before 1.1.2.3_999 Fixed in 1.1.2.3_999 Patch available CNA
- DSL-AC750 VendorASUS Affected earlier to before 1.1.2.3_999 Fixed in 1.1.2.3_999 Patch available CNA
- DSL-AC52U VendorASUS Affected earlier to before 1.1.2.3_999 Fixed in 1.1.2.3_999 Patch available CNA
- DSL-AC55U VendorASUS Affected earlier to before 1.1.2.3_999 Fixed in 1.1.2.3_999 Patch available CNA
- DSL-AC56U VendorASUS Affected earlier to before 1.1.2.3_999 Fixed in 1.1.2.3_999 Patch available CNA
- DSL-N10_C1 VendorASUS Affected All Fixed in — No fix listed CNA
- DSL-N10_D1 VendorASUS Affected All Fixed in — No fix listed CNA
- DSL-N10P_C1 VendorASUS Affected All Fixed in — No fix listed CNA
- DSL-N12E_C1 VendorASUS Affected All Fixed in — No fix listed CNA
- DSL-N16P VendorASUS Affected All Fixed in — No fix listed CNA
- DSL-N16U VendorASUS Affected All Fixed in — No fix listed CNA
- DSL-AC52 VendorASUS Affected All Fixed in — No fix listed CNA
- DSL-AC55 VendorASUS Affected All Fixed in — No fix listed CNA
CPE names CISA-ADP · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:asus:dsl-n55u_d1_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:dsl-n17u_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:dsl-n55u_c1_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:dsl-n66u_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:h:asus:dsl-n14u_b1:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:dsl-n14u_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:dsl-n12u_c1_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:dsl-ac56u_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:dsl-ac55u_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:dsl-ac52u_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
- cpe:2.3:o:asus:dsl-n55u_d1_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:dsl-n17u_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:dsl-n55u_c1_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:dsl-n66u_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:h:asus:dsl-n14u_b1:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:dsl-n14u_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:dsl-n12u_c1_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:dsl-ac56u_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:dsl-ac55u_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:dsl-ac52u_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:asus:dsl-ac750_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:dsl-ac51_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:dsl-n16p_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:dsl-n10p_c1_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:dsl-n10_d1_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:dsl-ac52_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:dsl-ac55_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:dsl-n16_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:dsl-n12e_c1_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
| cpe:2.3:o:asus:dsl-n10_c1_firmware:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | ASUS |
- cpe:2.3:o:asus:dsl-ac750_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:dsl-ac51_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:dsl-n16p_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:dsl-n10p_c1_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:dsl-n10_d1_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:dsl-ac52_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:dsl-ac55_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:dsl-n16_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:dsl-n12e_c1_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
- cpe:2.3:o:asus:dsl-n10_c1_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ASUS
Remediation
- Fix · CNA DSL-N17U (ASUS) Fixed in 1.1.2.3_792
- Fix · CNA DSL-N55U_C1 (ASUS) Fixed in 1.1.2.3_792
- Fix · CNA DSL-N55U_D1 (ASUS) Fixed in 1.1.2.3_792
- Fix · CNA DSL-N66U (ASUS) Fixed in 1.1.2.3_792
- Fix · CNA DSL-N12U_C1 (ASUS) Fixed in 1.1.2.3_807
- Fix · CNA DSL-N12U_D1 (ASUS) Fixed in 1.1.2.3_807
- Fix · CNA DSL-N14U (ASUS) Fixed in 1.1.2.3_807
- Fix · CNA DSL-N14U_B1 (ASUS) Fixed in 1.1.2.3_807
- Fix · CNA DSL-N16 (ASUS) Fixed in 1.1.2.3_999
- Fix · CNA DSL-AC51 (ASUS) Fixed in 1.1.2.3_999
- Fix · CNA DSL-AC750 (ASUS) Fixed in 1.1.2.3_999
- Fix · CNA DSL-AC52U (ASUS) Fixed in 1.1.2.3_999
- Fix · CNA DSL-AC55U (ASUS) Fixed in 1.1.2.3_999
- Fix · CNA DSL-AC56U (ASUS) Fixed in 1.1.2.3_999
Timeline
- 2026-10-02 Threatist record created from CVE-2024-3912
- 2026-10-03 Alias added: GHSA-67j2-frvf-p57m
- 2026-11-03 CISA SSVC decision points changed
References
More ASUS vulnerabilities
- TI-2021-12008 The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-36933 "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were… KEVCVSS 4.0CRITICAL 9.3
- TI-2023-20780 OS command injection in ASUS RT-AX55 KEVCVSS 3.1HIGH 8.8
- TI-2018-04367 An issue was discovered in AsusWRT before 3.0.0.4.384_10007. CVSS 3.0CRITICAL 9.8
- TI-2018-04368 An issue was discovered in AsusWRT before 3.0.0.4.384_10007. CVSS 3.0CRITICAL 9.8
- TI-2014-07780 common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and… CVSS 2.0HIGH 10.0
Sources
- CVE-2024-3912 · CVE Program
- CVE-2024-3912 · NVD
- FIRST EPSS
- GHSA-67j2-frvf-p57m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences