Cyber Resilience

CVE-2024-28326

Medium

Published: 26 April 2024

Published
26 April 2024
Modified
15 April 2026
KEV Added
Patch
CVSS Score v3.1 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0010 27.4th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-28326 is a medium-severity Improper Physical Access Control (CWE-1263) vulnerability in Asus (inferred from references). Its CVSS base score is 6.8 (Medium).

Operationally, ranked at the 27.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Incorrect Access Control in ASUS RT-N12+ B1 and RT-N12 D1 routers allows local attackers to obtain root terminal access via the the UART interface.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Asus
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-1263

Field maintenance requires physical or on-site access, and restricting it mitigates improper physical access control.

addresses: CWE-1263

Restricting access to media directly implements controls to prevent improper physical access to storage media.

addresses: CWE-1263

Physically controlling and securely storing media directly implements proper physical access controls for system media.

addresses: CWE-1263

Prohibiting portable storage devices without identifiable owners is a direct physical access control measure limiting untraceable media interaction with systems.

addresses: CWE-1263

Placement for authorized access and protection against unauthorized activation specifically address improper physical access control.

addresses: CWE-1263

Automatic emergency lighting ensures visibility on exits and evacuation routes during power outages, reducing an attacker's ability to exploit improper physical access controls by using darkness to navigate or access restricted areas.

addresses: CWE-1263

Directly implements authorization and control of physical items entering and exiting the facility to prevent improper physical access.

addresses: CWE-1263

Requiring documentation of allowed sites plus implementation and assessment of controls at alternate work sites directly prevents improper physical access to systems and data.

References