CVE-2024-31161
📋 TL;DR
This vulnerability in ASUS Download Master allows authenticated administrators to upload arbitrary files to any location on the system due to improper input filtering. Attackers can upload malicious web pages to execute arbitrary system commands when visited. Only systems running ASUS Download Master with administrative access are affected.
💻 Affected Systems
- ASUS Download Master
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via remote code execution, allowing attackers to install malware, steal data, or pivot to other systems.
Likely Case
Attackers with administrative credentials upload web shells to gain persistent remote access and execute commands on the server.
If Mitigated
Limited impact if proper access controls and file upload restrictions are implemented.
🎯 Exploit Status
Exploitation requires administrative credentials but is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Latest firmware updates from ASUS
Vendor Advisory: https://www.twcert.org.tw/en/cp-139-7866-469e0-2.html
Restart Required: Yes
Instructions:
1. Log into ASUS router admin interface. 2. Navigate to firmware update section. 3. Download and install latest firmware from ASUS. 4. Reboot router after update.
🔧 Temporary Workarounds
Disable Download Master
allTemporarily disable the vulnerable Download Master feature until patched.
Log into router admin panel → USB Application → Download Master → Disable
Restrict Admin Access
allLimit administrative access to trusted IP addresses only.
Log into router admin → Administration → System → Allow only specified IP addresses
🧯 If You Can't Patch
- Disable Download Master feature completely
- Implement network segmentation to isolate affected routers
🔍 How to Verify
Check if Vulnerable:
Check if Download Master is enabled on ASUS router and firmware version is outdated.Check Version:
Log into router admin → System Log → Firmware VersionVerify Fix Applied:
Verify firmware version matches latest release from ASUS and test upload functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to web directories
- Suspicious POST requests to upload endpoints
Network Indicators:
- Unexpected outbound connections from router
- Traffic to known malicious IPs
SIEM Query:
source="router_logs" AND (event="file_upload" OR uri="/upload")