Vulnerabilities in ASUS

154 results
Vexday analysis

Com 137 CVEs catalogadas, o portfólio de vulnerabilidades da ASUS apresenta uma taxa de exploração ativa 3,2 vezes acima da média geral do catálogo CISA KEV, o que indica que, proporcionalmente, as falhas nesse ecossistema têm maior chance de serem weaponizadas do que o esperado para vendors de porte similar. O tipo de falha mais recorrente é CWE-120 (buffer overflow clássico), uma classe de vulnerabilidade que frequentemente viabiliza execução remota de código e que exige atenção reforçada em processos de desenvolvimento e atualização de firmware. A CVE mais perigosa em exploração ativa no momento, CVE-2023-39780, registra um escore EPSS de 0,3216, sinalizando probabilidade relevante de exploração contínua e justificando priorização imediata de correção. Com 12 CVEs críticas e 7 novas entradas nos últimos 90 dias, equipes de segurança que operam ativos ASUS devem manter ciclos de patching curtos e monitorar ativamente indicadores de comprometimento associados às falhas confirmadas no KEV.

CVE-2024-3080CRITICALASUS Router - Improper AuthenticationEPSS 43.5%CVE-2023-35086HIGHASUS RT-AX56U V2 & RT-AC86U - Format String -1EPSS 38.5%CVE-2023-39780HIGHOn ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelistEPSS 33.9%KEVCVE-2022-35401CRITICALAn authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_49674-ge182230. A speciaEPSS 20.8%CVE-2022-38393HIGHA denial of service vulnerability exists in the cfg_server cm_processConnDiagPktList opcode of Asus RT-AX82U 3.0.0.4.386_49674-ge182230 routEPSS 18.8%CVE-2025-59366CRITICALAn authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba funcEPSS 16.1%CVE-2022-4221CRITICALOS command injection in ASUS M25 NASEPSS 4.8%CVE-2019-11063CRITICALSmartHome application has a broken access control vulnerability in its Web API ServerEPSS 4.5%CVE-2019-11061CRITICALHG100 has a broken access control vulnerability in its Web API ServerEPSS 4.0%CVE-2016-6558—The ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, is vulnerable to command injectionEPSS 3.5%CVE-2019-11060HIGHHG100 contains an Uncontrolled Resource Consumption vulnerabilityEPSS 3.0%CVE-2022-26674CRITICALASUS RT-AX88U - Format StringEPSS 2.6%CVE-2021-37910LOWASUS GT-AXE11000, RT-AX3000, RT-AX55, RT-AX58U, TUF-AX3000 - Improper AuthenticationEPSS 2.1%CVE-2024-1655HIGHASUS WiFi Router - OS Command InjectionEPSS 2.0%CVE-2021-28204HIGHASUS BMC's firmware: command injection - Modify user’s information functionEPSS 2.0%CVE-2021-28203HIGHASUS BMC's firmware: command injection - Web Set Media Image functionEPSS 2.0%CVE-2021-28209MEDIUMASUS BMC's firmware: path traversal - Delete video file functionEPSS 1.9%CVE-2021-28206MEDIUMASUS BMC's firmware: path traversal - Record video file functionEPSS 1.9%CVE-2021-28207MEDIUMASUS BMC's firmware: path traversal - Get Help file functionEPSS 1.9%CVE-2021-28205MEDIUMASUS BMC's firmware: path traversal - Delete SOL video file functionEPSS 1.9%