openwrt asu vulnerabilities

Latest openwrt asu CVEs

Newest publication first

1. CVE-2024-54143 openwrt/asu allows build artifact poisoning via truncated SHA-256 hash and command injection

   Published 2024-12-06

   Critical·CVSS 9.3 EPSS 1.8%

   openwrt/asu is an image on demand server for OpenWrt based distributions. The request hashing mechanism truncates SHA-256 hashes to only 12 characters. This significantly reduces entropy, making it feasible for an attacker to generate collisions. By exploiting this, a previously...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.