Vulnerability · Published Sep 7, 2023 · Assigned by twcert
CVE-2023-39238ASUS RT-AX55、RT-AX56U_V2 - Format String - 1
High 7.2
In plain English
A high-severity security flaw in RT-AX55 from ASUS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)1.4%top 28.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
It is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_svr.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ASUS | RT-AX55 | 3.0.0.4.386_50460 |
| ASUS | RT-AX56U_V2 | 3.0.0.4.386_50460 |
Weakness: CWE-134 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H