CVE-2023-35086

ASUS RT-AX56U V2 & RT-AC86U - Format String -1

View on CVE.org

Published Jul 21, 2023 CVSS 3.1 · 7.2 High EPSS 38.8% KEV · Not listed

Description

It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by directly using input as a format string when calling syslog in logmessage_normal function, in the do_detwan_cgi module of httpd. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.

This issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ASUS

RT-AX56U V2

unaffected

Version	Status	Constraints
`3.0.0.4.386_50460`	affected	—

ASUS

RT-AC86U

unaffected

Version	Status	Constraints
`3.0.0.4_386_51529`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:asus:rt-ac86u_firmware:3.0.0.4_386_51529:*:*:*:*:*:*:*

cpe:2.3:h:asus:rt-ac86u:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:asus:rt-ax56u_v2_firmware:3.0.0.4.386_50460:*:*:*:*:*:*:*

cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

Vendor Solution

RT-AX56U V2: update firmware version to 3.0.0.4_386_51598 RT-AC86U: update firmware version 3.0.0.4.386_51915

Tracking

Sign in to view the affected projects.

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 38.8% (38.758% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.twcert.org.tw/tw/cp-132-7240-a5f96-1.html

History

Oct 24, 2024 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Subscriptions

Asus Rt-ac86u Rt-ac86u Firmware Rt-ax56u V2 Rt-ax56u V2 Firmware

Weaknesses

CWE-134

Sources

CVE record Updated: Oct 24, 2024, 2:20 PM

Status: PUBLISHED
Assigner: twcert
Published: Jul 21, 2023, 6:32 AM
Updated: Oct 24, 2024, 2:20 PM
Reserved: Jun 13, 2023, 10:19 AM

View source JSON

Vulnrichment Updated: Aug 2, 2024, 4:23 PM

Updated: Aug 2, 2024, 4:23 PM

NVD Updated: Jun 17, 2026, 6:04 AM

Status: Modified
Published: Jul 21, 2023, 7:15 AM
Modified: Jun 17, 2026, 6:04 AM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment No data

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-35086", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2023-06-13T10:19:24.130Z", "datePublished": "2023-07-21T06:32:20.831Z", "dateUpdated": "2024-10-24T14:20:09.783Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "RT-AX56U V2", "vendor": "ASUS", "versions": [{"status": "affected", "version": "3.0.0.4.386_50460"}]}, {"defaultStatus": "unaffected", "product": "RT-AC86U", "vendor": "ASUS", "versions": [{"status": "affected", "version": "3.0.0.4_386_51529"}]}], "datePublic": "2023-07-21T06:16:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by directly using input as a format string when calling syslog in logmessage_normal function, in the do_detwan_cgi module of httpd. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.</span>\n\n<p>This issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529.</p>"}], "value": "\nIt is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by directly using input as a format string when calling syslog in logmessage_normal function, in the do_detwan_cgi module of httpd. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\nThis issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529.\n\n"}], "impacts": [{"capecId": "CAPEC-135", "descriptions": [{"lang": "en", "value": "CAPEC-135 Format String Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-134", "description": "CWE-134 Use of Externally-Controlled Format String", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-03-27T07:21:52.292Z"}, "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7240-a5f96-1.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<div>RT-AX56U V2: update firmware version to 3.0.0.4_386_51598</div><div>RT-AC86U: \n\nupdate firmware version\n\n 3.0.0.4.386_51915</div>\n\n<br>"}], "value": "\nRT-AX56U V2: update firmware version to 3.0.0.4_386_51598\n\nRT-AC86U: \n\nupdate firmware version\n\n 3.0.0.4.386_51915\n\n"}], "source": {"advisory": "TVN-202307001", "discovery": "EXTERNAL"}, "title": "ASUS RT-AX56U V2 & RT-AC86U - Format String -1", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T16:23:59.139Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7240-a5f96-1.html", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "asus", "product": "rt-ax56u_v2", "cpes": ["cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "3.0.0.4.386_50460", "status": "affected"}]}, {"vendor": "asus", "product": "rt-ac86u", "cpes": ["cpe:2.3:h:asus:rt-ac86u:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "3.0.0.4_386_51529", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-24T14:18:13.719783Z", "id": "CVE-2023-35086", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-24T14:20:09.783Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7240-a5f96-1.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T16:23:59.139Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-35086", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-24T14:18:13.719783Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ax56u_v2", "versions": [{"status": "affected", "version": "3.0.0.4.386_50460"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:asus:rt-ac86u:-:*:*:*:*:*:*:*"], "vendor": "asus", "product": "rt-ac86u", "versions": [{"status": "affected", "version": "3.0.0.4_386_51529"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-24T14:20:00.468Z"}}], "cna": {"title": "ASUS RT-AX56U V2 & RT-AC86U - Format String -1", "source": {"advisory": "TVN-202307001", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-135", "descriptions": [{"lang": "en", "value": "CAPEC-135 Format String Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ASUS", "product": "RT-AX56U V2", "versions": [{"status": "affected", "version": "3.0.0.4.386_50460"}], "defaultStatus": "unaffected"}, {"vendor": "ASUS", "product": "RT-AC86U", "versions": [{"status": "affected", "version": "3.0.0.4_386_51529"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "\nRT-AX56U V2: update firmware version to 3.0.0.4_386_51598\n\nRT-AC86U: \n\nupdate firmware version\n\n 3.0.0.4.386_51915\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<div>RT-AX56U V2: update firmware version to 3.0.0.4_386_51598</div><div>RT-AC86U: \n\nupdate firmware version\n\n 3.0.0.4.386_51915</div>\n\n<br>", "base64": false}]}], "datePublic": "2023-07-21T06:16:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7240-a5f96-1.html"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\nIt is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by directly using input as a format string when calling syslog in logmessage_normal function, in the do_detwan_cgi module of httpd. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\nThis issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529.\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by directly using input as a format string when calling syslog in logmessage_normal function, in the do_detwan_cgi module of httpd. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.</span>\n\n<p>This issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-134", "description": "CWE-134 Use of Externally-Controlled Format String"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-03-27T07:21:52.292Z"}}}, "cveMetadata": {"cveId": "CVE-2023-35086", "state": "PUBLISHED", "dateUpdated": "2024-10-24T14:20:09.783Z", "dateReserved": "2023-06-13T10:19:24.130Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2023-07-21T06:32:20.831Z", "assignerShortName": "twcert"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "RT-AX56U V2", "vendor": "ASUS", "versions": [{"status": "affected", "version": "3.0.0.4.386_50460"}]}, {"defaultStatus": "unaffected", "product": "RT-AC86U", "vendor": "ASUS", "versions": [{"status": "affected", "version": "3.0.0.4_386_51529"}]}], "source": "twcert@cert.org.tw"}, {"affectedData": [{"cpes": ["cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "rt-ax56u_v2", "vendor": "asus", "versions": [{"status": "affected", "version": "3.0.0.4.386_50460"}]}, {"cpes": ["cpe:2.3:h:asus:rt-ac86u:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "rt-ac86u", "vendor": "asus", "versions": [{"status": "affected", "version": "3.0.0.4_386_51529"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:asus:rt-ac86u_firmware:3.0.0.4_386_51529:*:*:*:*:*:*:*", "matchCriteriaId": "E3A1AA3F-0CCF-41B0-B8D7-2D72D82C0261", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:asus:rt-ac86u:-:*:*:*:*:*:*:*", "matchCriteriaId": "89095282-ABBD-4056-B731-7F05638DB1A6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:asus:rt-ax56u_v2_firmware:3.0.0.4.386_50460:*:*:*:*:*:*:*", "matchCriteriaId": "7201F0D9-5111-414B-8756-3B36838193CD", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:*", "matchCriteriaId": "FFFF5EF7-E4EC-4DA0-82B4-9996087B951F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "\nIt is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by directly using input as a format string when calling syslog in logmessage_normal function, in the do_detwan_cgi module of httpd. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\nThis issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529.\n\n"}], "id": "CVE-2023-35086", "lastModified": "2026-06-17T06:04:24.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "twcert@cert.org.tw", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-35086", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-10-24T14:18:13.719783Z", "version": "2.0.3"}}]}, "published": "2023-07-21T07:15:10.143", "references": [{"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-7240-a5f96-1.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-7240-a5f96-1.html"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-134"}], "source": "twcert@cert.org.tw", "type": "Secondary"}]}