CVE-2024-31161

Published Jun 14, 2024

Last updated 3 months ago

Overview

Description: The upload functionality of ASUS Download Master does not properly filter user input. Remote attackers with administrative privilege can exploit this vulnerability to upload any file to any location. They may even upload malicious web page files to the website directory, allowing arbitrary system commands to be executed upon browsing the webpage.
Source: twcert@cert.org.tw
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.2
Impact score: 5.9
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

twcert@cert.org.tw: CWE-434

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:asus:download_master:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FC91ABA7-A7BD-447E-9403-08F2C33A8802",
            "versionEndExcluding": "3.1.0.114"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References