CVE-2023-39240

Katalog CVE

CVSS 7.2 · High EPSS 1,3%

Kerentanan Use of Externally-Controlled Format String pada asus rt-ax55 firmware, asus rt-ax56u v2 firmware +1 lainnya. Skor CVSS 3.1 7.2 (High) menurut cert.org.tw.

Deskripsi (NVD)

It is identified a format string vulnerability in ASUS RT-AX56U V2’s iperf client function API. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_cli.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.

Rincian

Terbit di NVD

7 September 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber cert.org.tw
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-134: Use of Externally-Controlled Format String

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.twcert.org.tw/tw/cp-132-7356-021bf-1.html advisory pihak ketiga