CVE-2024-3080

published 2024-06-14

CVE-2024-3080: Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in the device.

Priority P1 93 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV

Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in the device.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
asus	rt-ac68u	earlier – 3.0.0.4.386_51668	—
asus	rt-ac86u	earlier – 3.0.0.4.386_51915	—
asus	rt-ax57	earlier – 3.0.0.4.386_52294	—
asus	rt-ax58u	earlier – 3.0.0.4.388_23925	—
asus	rt-ax88u	earlier – 3.0.0.4.388_24198	—
asus	zenwifi_xt8	earlier – 3.0.0.4.388_24609	—
asus	zenwifi_xt8_v2	earlier – 3.0.0.4.388_24609	—

Detection & IOCs extracted from sources · hover to see the quote

url /js/..%2f%2f/wizard.htm↗

url /images/..%2f%2f/wizard.htm↗

path /js/..%2f%2f/wizard.htm↗

snort

alert http1 any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS ASUS DSL-AC88U Authentication Bypass Attempt (CVE-2024-3080)"; flow:established,to_server; http.request_line; content:"GET "; pcre:"/^\x2f(?:js|images)\x2f[^\x26]*?(?:(?:\x2e|%2[Ee]){1,2}(?:\x2f|\x5c|%5[Cc]|%2[Ff]){1,}){1,}/R"; content:"wizard.htm HTTP/1.1"; fast_pattern; endswith; reference:cve,2024-3080; reference:url,github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3080.yaml; classtype:attempted-admin; sid:2061409; rev:1; metadata:affected_product Asus, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_04_09, cve CVE_2024_3080, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_04_09, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

• → Authentication bypass is triggered by prepending path segments '/js/..%2f%2f' or '/images/..%2f%2e' to the target URL, causing the router to treat the request as authenticated. ↗
• → Successful exploitation returns HTTP 200 with the string 'show_wizardmenu();' in the response body — use this as a confirmation matcher. ↗
• → The Snort/ET rule targets plaintext HTTP (tls_state: plaintext) GET requests to the router containing 'wizard.htm HTTP/1.1' at the end of the request line, with path traversal sequences under /js/ or /images/ prefixes. ↗
• → The PCRE pattern in the ET rule matches URL-encoded and literal dot-dot-slash traversal sequences: both %2e/%2E and literal dots, combined with %2f/%5c or literal slashes/backslashes. ↗

• · The exploit targets only plaintext HTTP traffic; the ET Snort rule explicitly notes tls_state: plaintext, meaning HTTPS-wrapped management interfaces will not be detected by this rule. ↗
• · The Nuclei template uses 'stop-at-first-match: true' across two probe paths, so only the first successful bypass path will be confirmed during automated scanning — both paths should be tested independently for full coverage. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vulncheck 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-287