PT-2023-4801 · Asus · Asus Rt-Ac86U+2
Published
2023-07-10
·
Updated
2024-03-28
·
CVE-2023-39239
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
ASUS RT-AX56U V2 (affected versions not specified)
ASUS RT-AX55 (affected versions not specified)
ASUS RT-AC86U (affected versions not specified)
Description
A format string vulnerability is identified in the General function API of the affected devices. This issue is caused by a lack of validation for a specific value within the apply.cgi module. A remote attacker can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation, or disrupt service. The attacker may need administrator privilege to exploit the vulnerability, although some sources suggest it can be exploited without privilege.
Recommendations
For ASUS RT-AX56U V2, consider disabling the apply.cgi module until a patch is available.
For ASUS RT-AX55 and ASUS RT-AC86U, restrict access to the General function API to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Use of Externally-Controlled Format String
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Asus Rt-Ac86U
Asus Rt-Ax55
Asus Rt-Ax56U V2