CVE-2024-28328
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A CSV Injection vulnerability in the Asus RT-N12+ router allows an administrator to inject arbitrary commands or formulas into the client name parameter. When exported to CSV format, the injected code can be executed in another user's session upon opening the file.
Risk Assessment
An attacker can exploit this vulnerability to execute malicious commands on another user's computer when they open the exported CSV file, potentially leading to data theft or system compromise.
Recommendation
It is recommended to immediately update the Asus RT-N12+ router firmware to the latest version that fixes this vulnerability. Additionally, avoid opening CSV files from untrusted sources.
Original NVD description (English source)
CSV Injection vulnerability in the Asus RT-N12+ router allows administrator users to inject arbitrary commands or formulas in the client name parameter which can be triggered and executed in a different user session upon exporting to CSV format.