ASUS · RT-AX55 Routers
CVE-2023-39780
ASUS RT-AX55 Routers OS Command Injection Vulnerability
What it is
On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar "token-generated module" issue, see CVE-2023-41345; for the similar "token-refresh module" issue, see CVE-2023-41346; for the similar "check token module" issue, see CVE-2023-41347; and for the similar "code-authentication module" issue, see CVE-2023-41348.
CISA: ASUS RT-AX55 devices contain an OS command injection vulnerability that could allow a remote, authenticated attacker to execute arbitrary commands. As represented by CVE-2023-41346.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: June 23, 2025
- Added to the CISA list
- June 2, 2025
- Published
- September 11, 2023
- Severity
- High 8.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 40% in the top 1.4% of all known vulnerabilities
- Weakness
- CWE-78
- More details
- NVD · CVE.org · CISA
All references (6)
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/1/EN.md
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/2/EN.md
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/3/EN.md
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/4/EN.md
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/5/EN.md
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/6/EN.md
More exploited flaws from ASUS
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Dec 17, 2025 | Embedded Malicious Code | Live Update | Critical 9.3 | 1.2% |
| Jun 2, 2025 | Improper Authentication | Routers | Critical 9.8 | 99.4% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.