Description
It is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_svr.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.
Scores
CVSS v3
7.2
EPSS
0.0350
EPSS Percentile
87.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-134
Status
published
Products (3)
asus/rt-ac86u_firmware
3.0.0.4_386_51529
asus/rt-ax55_firmware
3.0.0.4.386_50460
asus/rt-ax56u_v2_firmware
3.0.0.4.386_50460
Published
Sep 07, 2023
Tracked Since
Feb 18, 2026