CVE-2023-39239
Estado: ModificadaAlta (7.2)—
It is identified a format string vulnerability in ASUS RT-AX56U V2’s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 7.2
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.28%
- Percentil entre todas las CVEs puntuadas: 69
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (3)
CWE
- CWE-134
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-39239",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-39239",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-09-26T18:53:39.966621Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "twcert@cert.org.tw",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.2,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "HIGH",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.2
}
]
},
"affected": [
{
"source": "twcert@cert.org.tw",
"affectedData": [
{
"vendor": "ASUS",
"product": "RT-AX55",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "ASUS",
"product": "RT-AX56U_V2",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "ASUS",
"product": "RT-AC86U",
"versions": [
{
"status": "affected",
"version": "3.0.0.4_386_51529"
}
],
"defaultStatus": "unaffected"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"cpes": [
"cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:*"
],
"vendor": "asus",
"product": "rt-ax56u_v2",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
],
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:*"
],
"vendor": "asus",
"product": "rt-ax55",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:h:asus:rt-ac86u:-:*:*:*:*:*:*:*"
],
"vendor": "asus",
"product": "rt-ac86u",
"versions": [
{
"status": "affected",
"version": "3.0.0.4_386_51529"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2023-09-07T08:15:07.620",
"references": [
{
"url": "https://https://www.twcert.org.tw/tw/cp-132-7355-0ce8d-1.html",
"tags": [
"Broken Link"
],
"source": "twcert@cert.org.tw"
},
{
"url": "https://https://www.twcert.org.tw/tw/cp-132-7355-0ce8d-1.html",
"tags": [
"Broken Link"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "twcert@cert.org.tw",
"description": [
{
"lang": "en",
"value": "CWE-134"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "\nIt is identified a format string vulnerability in ASUS RT-AX56U V2’s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\n"
},
{
"lang": "es",
"value": "Se identificó una vulnerabilidad de cadena de formato en la API de función general de ASUS RT-AX56U V2. Esta vulnerabilidad se debe a la falta de validación de un valor específico dentro de su módulo apply.cgi. Un atacante remoto no autenticado puede aprovechar esta vulnerabilidad sin privilegios para realizar la ejecución remota de código arbitrario, el funcionamiento arbitrario del sistema o interrumpir el servicio."
}
],
"lastModified": "2026-06-17T06:11:49.707",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386_50460:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "55D08B1A-85B6-4501-8998-E308F7633DF9"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B8F27D4F-EDC4-4676-8C66-545378850BF1"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:asus:rt-ax56u_v2_firmware:3.0.0.4.386_50460:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7201F0D9-5111-414B-8756-3B36838193CD"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FFFF5EF7-E4EC-4DA0-82B4-9996087B951F"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:asus:rt-ac86u_firmware:3.0.0.4_386_51529:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E3A1AA3F-0CCF-41B0-B8D7-2D72D82C0261"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:asus:rt-ac86u:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "89095282-ABBD-4056-B731-7F05638DB1A6"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "twcert@cert.org.tw"
}