CVE-2024-31161 Overview
CVE-2024-31161 is an arbitrary file upload vulnerability in ASUS Download Master. The upload functionality fails to filter user-supplied input, allowing authenticated remote attackers with administrative privileges to write files to arbitrary locations. Attackers can place malicious web files inside the web root and execute system commands when the page is requested. The flaw is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type.
Critical Impact
Authenticated administrators can upload arbitrary files to any location on the device, achieving remote code execution as the Download Master service.
Affected Products
- ASUS Download Master (see vendor advisory for fixed version)
- Deployments running Download Master on ASUS routers with the module enabled
- Any configuration exposing the Download Master administrative interface to untrusted networks
Discovery Timeline
- 2024-06-14 - CVE-2024-31161 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-31161
Vulnerability Analysis
ASUS Download Master is a file management and download module bundled with ASUS routers. The application exposes an administrative upload endpoint intended for handling user files. The endpoint does not validate file names, extensions, or destination paths supplied by the client. As a result, an authenticated administrator can direct uploads to any writable directory on the device, including the web server document root.
Because the Download Master web interface serves scripts through an embedded server, files planted inside the web directory are executed by the interpreter when requested. This converts an authenticated file write primitive into arbitrary command execution on the underlying operating system. The exploitation path requires administrative credentials but no user interaction, and the entire chain runs over the network.
Root Cause
The root cause is missing server-side validation of upload parameters, classified as [CWE-434]. The application trusts user-controlled destination paths and file names without enforcing an allowlist of extensions, a sanitized upload directory, or content-type checks. Authorization alone is treated as sufficient to write anywhere on disk.
Attack Vector
An attacker who obtains administrative credentials, through phishing, credential reuse, default credentials, or session hijacking, sends a crafted upload request to the Download Master interface. The request specifies a destination inside the web root and a payload containing server-executable content. Requesting the uploaded file then triggers command execution in the context of the Download Master process.
No verified proof-of-concept code is publicly available. See the TW-CERT Security Advisory for vendor details.
Detection Methods for CVE-2024-31161
Indicators of Compromise
- Unexpected files, especially executable script files, appearing inside the Download Master web directory or router file system
- Administrative logins to Download Master from unfamiliar IP addresses followed by upload requests
- Outbound connections from the router to attacker-controlled infrastructure after an upload event
- New cron entries, startup scripts, or persistence artifacts on the router file system
Detection Strategies
- Inspect HTTP request logs for POST requests to Download Master upload endpoints containing suspicious destination paths or file extensions
- Compare the Download Master web directory contents against a known-good baseline to identify unauthorized files
- Correlate administrative authentication events with subsequent file write and command execution activity on the device
Monitoring Recommendations
- Forward router and Download Master logs to a centralized log platform for retention and correlation
- Alert on any modification to files inside the Download Master web root outside of scheduled updates
- Monitor for anomalous process execution originating from the Download Master service account
How to Mitigate CVE-2024-31161
Immediate Actions Required
- Update ASUS Download Master to the fixed version identified in the TW-CERT Security Advisory
- Restrict access to the Download Master administrative interface to trusted management networks only
- Rotate administrative credentials and enforce strong, unique passwords for the router and Download Master
- Audit the Download Master web directory and router file system for unauthorized files
Patch Information
ASUS has published guidance through TW-CERT. Refer to the TW-CERT Security Advisory and the TW-CERT Incident Report for the fixed release and update instructions. Apply the vendor-supplied firmware or module update on all affected devices.
Workarounds
- Disable the Download Master module on routers where the feature is not required
- Block WAN-side access to the router administrative interface and Download Master ports at the network perimeter
- Require VPN access for any remote administration of the router
- Enable account lockout and monitor authentication logs to reduce the risk of credential compromise
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
