cbcvebase.
CVE-2024-12912
published 2025-01-02

CVE-2024-12912: An improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution. Refer to the '01/02/2025 ASUS Router…

PriorityP276high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
1.24%
65.6th percentile
An improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution. Refer to the '01/02/2025 ASUS Router AiCloud vulnerability' section on the ASUS Security Advisory for more information.

Affected

4 ranges
VendorProductVersion rangeFixed in
asusrouter——
asusrouter——
asusrouter——
asusrouter——

Detection & IOCsextracted from sources · hover to see the quote

otherSelf-signed TLS certificate with 100-year lifetime in AiCloud services↗
  • →Hunt for ASUS routers presenting a self-signed TLS certificate on AiCloud services with a validity period of ~100 years; this certificate replacement was observed in 99% of compromised devices and was used to identify ~50,000 infected IPs. ↗
  • →CVE-2024-12912 is exploited via the ASUS AiCloud service; monitor for unexpected or crafted requests targeting AiCloud endpoints on ASUS routers, particularly AC-series and AX-series devices. ↗
  • →Absence of infections within China-geolocated IPs may help with threat actor attribution; consider this geographic exclusion pattern when correlating campaign activity. ↗
  • ·CVE-2024-12912 specifically requires the AiCloud feature to be enabled on the router; devices without AiCloud active are not exposed to this attack vector. ↗
  • ·Compromised routers are not having their firmware upgraded by the attackers, meaning they remain vulnerable to takeover by additional threat actors even after initial compromise. ↗

CVSS provenance

nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vulncheck7.2HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.