CVE-2023-35086

high-risk
Published 2023-07-21

It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by directly using input as a format string when calling syslog in logmessage_normal function, in the do_detwan_cgi module of httpd. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service. This issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529.

Do I need to act?

!
75.1% chance of exploitation in next 30 days
EPSS score — higher than 25% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.2/10 High
NETWORK / LOW complexity

Affected Products (2)

Rt-Ac86U Firmware
Rt-Ax56U V2 Firmware

Affected Vendors

Asus

References (2)

Third Party Advisory https://www.twcert.org.tw/tw/cp-132-7240-a5f96-1.html
Third Party Advisory https://www.twcert.org.tw/tw/cp-132-7240-a5f96-1.html
52
/ 100
high-risk
Severity 26/34 · High
Exploitability 19/34 · Moderate
Exposure 7/34 · Low