CVE-2023-35087

· CRITICALModified

← All CVEs

CVSS v3.1

9.8

EPSS

1.07%

Published

Jul 21, 2023

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by lacking validation for a specific value when calling cm_processChangedConfigMsg in ccm_processREQ_CHANGED_CONFIG function in AiMesh system. An unauthenticated remote attacker can exploit this vulnerability without privilege to perform remote arbitrary code execution, arbitrary system operation or disrupt service. This issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-134CWE-134

Affected Products (4)

asus · rt-ac86u_firmwarevulnerable

asus · rt-ac86u

asus · rt-ax56u_v2_firmwarevulnerable

asus · rt-ax56u_v2

References (2)

https://www.twcert.org.tw/tw/cp-132-7249-ab2d1-1.html

Third Party Advisory

https://www.twcert.org.tw/tw/cp-132-7249-ab2d1-1.html

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs