PT-2023-7410 · Asus · Asus Rt-Ac86U+1

Published 2023-11-02 · Updated 2025-12-02 · CVE-2023-41345

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ASUS RT-AX55 (affected versions not specified) ASUS RT-AC86U (affected versions not specified)

Description The authentication-related function in ASUS routers has a flaw due to inadequate filtering of special characters within the token-generated module. A remote attacker who is already authenticated can exploit this to perform a Command Injection attack. This could allow the attacker to execute arbitrary commands, disrupt the system, or terminate services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-08447

CVE-2023-41345

Affected Products

Asus Rt-Ac86U

Asus Rt-Ax55

References · 19

• https://osv.dev/vulnerability/CVE-2023-41345 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41345 · Security Note
• https://bdu.fstec.ru/vul/2023-08447 · Security Note
• https://t.me/aptreports/23810 · Telegram Post
• https://t.me/cvenotify/124380 · Telegram Post
• https://t.me/cvenotify/122602 · Telegram Post
• https://twitter.com/CCBalert/status/1930351702906925212 · Twitter Post
• https://t.me/aptreports/23915 · Telegram Post
• https://t.me/NeKaspersky/4762 · Telegram Post
• https://twitter.com/transilienceai/status/1992835604447400232 · Twitter Post
• https://t.me/true_secator/7645 · Telegram Post
• https://twcert.org.tw/tw/cp-132-7496-96e2c-1.html · Note
• https://twitter.com/CVEnew/status/1720299267439378652 · Twitter Post
• https://asus.com/content/asus-product-security-advisory · Note
• https://t.me/cveNotify/141128 · Telegram Post