High severity · published Jun 14, 2024
CVE-2024-31161
The upload functionality of ASUS Download Master does not properly filter user input
7.2
CVSS
0.5%
EPSS
No
On KEV
Description
The upload functionality of ASUS Download Master does not properly filter user input. Remote attackers with administrative privilege can exploit this vulnerability to upload any file to any location. They may even upload malicious web page files to the website directory, allowing arbitrary system commands to be executed upon browsing the webpage.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DM
Download Master · Asus
before 3.1.0.114 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-31161
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-31161
Third Party Advisory
https://www.twcert.org.tw/en/cp-139-7866-469e0-2.html
Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-7865-d3823-1.html
More from Download Master
4.8
CVE-2024-31160
The parameter used in the certain page of ASUS Download Master is not properly filtered for user input
4.8
CVE-2024-31159
The parameter used in the certain page of ASUS Download Master is not properly filtered for user input