CVE-2024-12912
Published: 02 January 2025
Summary
CVE-2024-12912 is a high-severity Improper Input Validation (CWE-20) vulnerability in Asus (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-12912 is an improper input insertion vulnerability (CWE-20, CWE-77) affecting AiCloud on certain ASUS router models. Published on January 2, 2025, this flaw allows for arbitrary command execution due to inadequate validation of user-supplied input. The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H).
Attackers can exploit this vulnerability over the network with low complexity, provided they possess high privileges such as administrative access to the router (PR:H) and without requiring user interaction. Successful exploitation enables arbitrary command execution, resulting in high impacts to confidentiality, integrity, and availability on the targeted device.
The ASUS Product Security Advisory provides further details, including mitigation guidance, in the '01/02/2025 ASUS Router AiCloud vulnerability' section, accessible at https://www.asus.com/content/asus-product-security-advisory/.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51187
Vulnerability details
An improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution. Refer to the '01/02/2025 ASUS Router AiCloud vulnerability' section on the ASUS Security Advisory for more information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authenticated command injection in exposed AiCloud web service on routers directly enables T1190 exploitation of public-facing apps and T1059.008 network device CLI execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the improper input insertion (CWE-20, CWE-77) by enforcing validation of user-supplied inputs to AiCloud, preventing arbitrary command injection.
Remediates the specific flaw in AiCloud through timely application of vendor patches as detailed in the ASUS security advisory.
Minimizes exposure to the AiCloud vulnerability by disabling or restricting non-essential functionalities on the router.