PT-2023-7411 · Asus · Asus Rt-Ac86U+1

Published 2023-11-02 · Updated 2025-11-24 · CVE-2023-41346

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ASUS RT-AX55 (affected versions not specified) ASUS RT-AC86U (affected versions not specified)

Description The authentication-related function in the ASUS RT-AX55 and RT-AC86U routers has a vulnerability due to insufficient filtering of special characters within its token-refresh module. This allows an authenticated remote attacker to exploit the vulnerability and perform a Command Injection attack, enabling them to execute arbitrary commands, disrupt the system, or terminate services.

Recommendations For ASUS RT-AX55, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For ASUS RT-AC86U, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-08448

CVE-2023-41346

Affected Products

Asus Rt-Ac86U

Asus Rt-Ax55

References · 14

• https://bdu.fstec.ru/vul/2023-08448 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-41346 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41346 · Vendor Advisory
• https://t.me/aptreports/23810 · Telegram Post
• https://asus.com/content/asus-product-security-advisory · Note
• https://t.me/cveNotify/141128 · Telegram Post
• https://vuldb.com/ru/?id.244406 · Note
• https://t.me/cvenotify/124412 · Telegram Post
• https://twcert.org.tw/tw/cp-132-7497-f92ac-1.html · Note
• https://t.me/cvenotify/124380 · Telegram Post
• https://t.me/cvenotify/122602 · Telegram Post
• https://twitter.com/CVEnew/status/1720299266516595131 · Twitter Post
• https://t.me/aptreports/23915 · Telegram Post
• https://t.me/cvenotify/124538 · Telegram Post