Vulnerability Intelligence Report
ASUS RT-AX56U V2 & RT-AC86U - Format String -1
CVE-2023-35086
It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by directly using input as a format string when calling syslog in logmessage_normal function, in the do_detwan_cgi module of httpd. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service. This issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529.
No Active Exploit Signals
CVSS Base Score
7.2
HIGH
Exploitability:1.3
Impact Score:5.9
EPSS Probability:39.70%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-134 ↗CWE-134 Use of Externally-Controlled Format String
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| ASUS | RT-AX56U V2 | 3.0.0.4.386_50460 (affected) |
| ASUS | RT-AC86U | 3.0.0.4_386_51529 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
39.705%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | TWCERT/CC · CERT · Taiwan |
| Reserved | 2023-06-13T10:19:24 |
| Published | 2023-07-21T06:32:20 |
| Patch Date | 2023-07-21 |
| Last Updated | 2024-10-24T14:20:09 |
Community Chatter & Buzz