CVE-2024-0401: ASUS Expertwifi

High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days.

ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS ExpertWiFi, ASUS RT-AX55, ASUS RT-AX58U, ASUS RT-AC67U, ASUS RT-AC68R, ASUS RT-AC68U, ASUS RT-AX86, ASUS RT-AC86U, ASUS RT-AX88U, and ASUS RT-AX3000.

Affected products

ASUS Expertwifi: before 3.0.0.6.102_44544 (fixed in 3.0.0.6.102_44544)
ASUS Rt-AC1900: before 3.0.0.4.386_51685 (fixed in 3.0.0.4.386_51685)
ASUS Rt-AC1900U: before 3.0.0.4.386_51685 (fixed in 3.0.0.4.386_51685)
ASUS Rt-AC2900: before 3.0.0.4.386_51925 (fixed in 3.0.0.4.386_51925)
ASUS Rt-AC67U: before 3.0.0.4.386_51685 (fixed in 3.0.0.4.386_51685)
ASUS Rt-AC68P: before 3.0.0.4.386_51685 (fixed in 3.0.0.4.386_51685)
ASUS Rt-AC68R: before 3.0.0.4.386_51685 (fixed in 3.0.0.4.386_51685)
ASUS Rt-AC68U: before 3.0.0.4.386_51685 (fixed in 3.0.0.4.386_51685)
ASUS Rt-AC86U: before 3.0.0.4.386_51925 (fixed in 3.0.0.4.386_51925)
ASUS Rt-AC88U: before 3.0.0.4.388_24209 (fixed in 3.0.0.4.388_24209)
ASUS Rt-AX3000: before 3.0.0.4.388_24762 (fixed in 3.0.0.4.388_24762)
ASUS RT-AX55: before 3.0.0.4.386_52303 (fixed in 3.0.0.4.386_52303)
ASUS Rt-AX58U: before 3.0.0.4.388_24762 (fixed in 3.0.0.4.388_24762)
ASUS Rt-AX86 Series: before 3.0.0.4.388_24243 (fixed in 3.0.0.4.388_24243)
ASUS Rt-AX88U: before 3.0.0.4.388_24209 (fixed in 3.0.0.4.388_24209)
ASUS Zenwifi XT8: before 3.0.0.4.388_24621 (fixed in 3.0.0.4.388_24621)

Published 2024-05-20. Last modified 2026-06-17.