« Volver al listado

CVE-2023-39238

Estado: ModificadaAlta (7.2)—

It is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_svr.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Asus — Rt-ac86u FirmwareAsus — Rt-ax55 FirmwareAsus — Rt-ax56u V2 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-39238",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-39238",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-26T18:57:07.141155Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "twcert@cert.org.tw",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "twcert@cert.org.tw",
      "affectedData": [
        {
          "vendor": "ASUS",
          "product": "RT-AX55",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0.4.386_50460"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "ASUS",
          "product": "RT-AX56U_V2",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0.4.386_50460"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:*"
          ],
          "vendor": "asus",
          "product": "rt-ax56u_v2",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0.4.386_50460"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:*"
          ],
          "vendor": "asus",
          "product": "rt-ax55",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0.4.386_50460"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-09-07T08:15:07.533",
  "references": [
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-7354-4e654-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "twcert@cert.org.tw"
    },
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-7354-4e654-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "twcert@cert.org.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-134"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "\nIt is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_svr.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\n"
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad de cadena de formato en ASUS RT-AX56U V2. Esta vulnerabilidad se debe a la falta de validación de un valor específico dentro de su módulo set_iperf3_svr.cgi. Un atacante remoto no autenticado puede aprovechar esta vulnerabilidad sin privilegios para realizar la ejecución remota de código arbitrario, el funcionamiento arbitrario del sistema o interrumpir el servicio."
    }
  ],
  "lastModified": "2026-06-17T06:11:49.580",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386_50460:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "55D08B1A-85B6-4501-8998-E308F7633DF9"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B8F27D4F-EDC4-4676-8C66-545378850BF1"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:asus:rt-ax56u_v2_firmware:3.0.0.4.386_50460:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7201F0D9-5111-414B-8756-3B36838193CD"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "FFFF5EF7-E4EC-4DA0-82B4-9996087B951F"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:asus:rt-ac86u_firmware:3.0.0.4_386_51529:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E3A1AA3F-0CCF-41B0-B8D7-2D72D82C0261"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:asus:rt-ac86u:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "89095282-ABBD-4056-B731-7F05638DB1A6"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "twcert@cert.org.tw"
}