Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-1655 | Kitploit
Tools/GitHubGitHub/lnversed/cve-2024-1655
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCommand and ControlRed Teaming
GitHublnversed/cve-2024-1655

CVE-2024-1655

View Repository
12 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2024-1655

Description

ASUS ExpertWiFi EBM63, EBM68, and RT-AX57 Go firmwares before the 12-04-2024 patch contain a command injection vulnerability in splash_page_SDN.cgi function. When an attacker sends a specially crafted request, they can achieve arbitrary code execution.

references:

  • Official report

Usage

The vulnerability is an authenticated RCE, users of this script are required to first retrieve the login token (value of asus_token from the cookie header) of the target.

root@kitploit:~
$ python3 CVE-2024-1655.py --host <TARGET_HOST> --token <ASUS_TOKEN> <COMMAND>

Example: Creating a file in the tmp directory

root@kitploit:~
$ python3 CVE-2024-1655.py --host http://192.168.1.1:8080 --token pEnRts37WwOZT1qwwJjhRWFhfBLBmNQ "echo pwned > /tmp/pwn.txt"

Disclaimer

The author created this software for the sole purposes of academic research and aiding in understanding associated security risks. In addition, this software is not intended to be used to attack systems except where explicitly authorized. Project maintainers are not responsible or liable for misuse of the software. Responsible usage is advised.

Download Tool