PT-2023-5282 · Asus · Asus Rt-Ax88U

Published 2023-07-26 · Updated 2023-09-19 · CVE-2023-41349

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ASUS RT-AX88U (affected versions not specified)

Description The issue is related to the use of externally controllable format strings within the Advanced Open VPN function of the ASUS RT-AX88U router. An authenticated remote attacker can exploit the exported OpenVPN configuration to execute an externally-controlled format string attack. This can result in sensitivity information leakage or force the device to reset, leading to permanent denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

BDU:2023-05905

CVE-2023-41349

Affected Products

Asus Rt-Ax88U

References · 9

• https://osv.dev/vulnerability/CVE-2023-41349 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41349 · Security Note
• https://bdu.fstec.ru/vul/2023-05905 · Security Note
• https://twitter.com/vuldb/status/1703761546336456796 · Twitter Post
• https://t.me/cvenotify/58087 · Telegram Post
• https://asus.com/ru/networking-iot-servers/wifi-routers/asus-gaming-routers/rt-ax88u/helpdesk_bios/?model2Name=RT-AX88U · Note
• https://twcert.org.tw/tw/cp-132-7371-aecf1-1.html · Note
• https://twitter.com/cracbot/status/1704012485685301515 · Twitter Post
• https://vuldb.com/?id.239881 · Note