Cyber Resilience

CVE-2024-26342

HighPublic PoC

Published: 28 February 2024

Published
28 February 2024
Modified
28 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0054 68.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-26342 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Asus 4G-Ac68U Firmware. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Network Denial of Service (T1498); ranked in the top 32.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

A Null pointer dereference in usr/sbin/httpd in ASUS AC68U 3.0.0.4.384.82230 allows remote attackers to trigger DoS via network packet.

CWE(s)
CWE-476

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1498 Network Denial of Service Impact
Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Null pointer dereference in httpd allows remote attackers to crash the service via crafted network packet, enabling Network Denial of Service (T1498) and Endpoint Denial of Service via application exploitation (T1499.004).

Affected Assets

asus
4g-ac68u firmware
3.0.0.4.384.82230

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References