« Volver al listado

CVE-2024-33278

Estado: AplazadaCrítica (9.8)—

Buffer Overflow vulnerability in ASUS router RT-AX88U with firmware versions v3.0.0.4.388_24198 allows a remote attacker to execute arbitrary code via the connection_state_machine due to improper length validation for the cookie field.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Asus — Rt-ax88uAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-33278",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-33278",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-24T17:42:38.816842Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:asus:rt-ax88u_firmware:3.0.0.4.388_24198:*:*:*:*:*:*:*"
          ],
          "vendor": "asus",
          "product": "rt-ax88u_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0.4.388_24198"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-06-24T14:15:11.687",
  "references": [
    {
      "url": "https://gist.github.com/viktoredstrom/cd2580fb0e93e47133b2998553b0a52f",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.asus.com/content/asus-product-security-advisory/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://gist.github.com/viktoredstrom/cd2580fb0e93e47133b2998553b0a52f",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.asus.com/content/asus-product-security-advisory/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Buffer Overflow vulnerability in ASUS router RT-AX88U with firmware versions v3.0.0.4.388_24198 allows a remote attacker to execute arbitrary code via the connection_state_machine due to improper length validation for the cookie field."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de desbordamiento de búfer en el enrutador ASUS RT-AX88U con versiones de firmware v3.0.0.4.388_24198 permite a un atacante remoto ejecutar código arbitrario a través de Connection_state_machine debido a una validación de longitud incorrecta para el campo de cookies."
    }
  ],
  "lastModified": "2026-06-17T07:31:37.180",
  "sourceIdentifier": "cve@mitre.org"
}