CVE-2024-33278.txt

[Suggested description]
Buffer overflow vulnerability in ASUS router RT-AX88U with firmware versions v3.0.0.4.388_24198 allows a remote attacker to execute arbitrary code via the connection_state_machine function due to improper length validation for the cookie field.

------------------------------------------

[Vulnerability Type]
Buffer overflow

------------------------------------------

[Vendor of Product]
ASUS

------------------------------------------

[Affected Product Code Base]
Product: RT-AX88U
Version: Affected at 3.0.0.4.388_24198

------------------------------------------

[Affected Component]
Affected executable: lighttpd

------------------------------------------

[Attack Type]
Remote

------------------------------------------

[Impact Code execution]
True

------------------------------------------

[Attack Vectors]
To exploit the vulnerability the attacker needs to be able to access the routers web server, usually by being on the same local area network.

------------------------------------------

[Reference]
https://www.asus.com/content/asus-product-security-advisory/

------------------------------------------

[Has vendor confirmed or acknowledged the vulnerability?]
True

------------------------------------------

[Discoverer]
Viktor Edström