Skip to content
OpenAdvisories
High · 7.2 Public exploit CVE-2023-35086 EUVD-2023-39121GHSA-r4fx-9v33-wcf4

ASUS RT-AX56U V2 & RT-AC86U - Format String -1

Published Jul 21, 2023 · Updated Oct 24, 2024 · Assigned by twcert

Vendor: ASUS Product: RT-AC86U Product: RT-AX56U_V2

Description

It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by directly using input as a format string when calling syslog in logmessage_normal function, in the do_detwan_cgi module of httpd. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.

This issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529.

Affected products

VendorProductAffectedFixed
ASUS RT-AX56U V2 3.0.0.4.386_50460 —
ASUS RT-AC86U 3.0.0.4_386_51529 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References