CVE-2023-39780
ASUS RT-AX55 Routers OS Command Injection Vulnerability
Description
CVE-2023-39780 is a high-severity OS command injection vulnerability in ASUS RT-AX55 routers running firmware version 3.0.0.4.386.51598. Authenticated attackers can inject and execute arbitrary operating system commands through the qos_bw_rulelist parameter on the /start_apply.htm page. With a CVSS v3.1 score of 8.8 (HIGH), the vulnerability requires only low-level authenticated access and no user interaction, enabling complete system compromise of the affected router. CISA has confirmed active exploitation by adding CVE-2023-39780 to the Known Exploited Vulnerabilities catalog with a deadline of June 23, 2025, and the EPSS score of 42.66% at the 97.39th percentile indicates very high exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| asus | rt-ax55 firmware | 3.0.0.4.386.51598 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/1/EN.md(Exploit, Third Party Advisory)
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/2/EN.md(Exploit, Third Party Advisory)
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/3/EN.md(Exploit, Third Party Advisory)
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/4/EN.md(Exploit, Third Party Advisory)
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/5/EN.md(Exploit, Third Party Advisory)
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/6/EN.md(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-39780(US Government Resource)
- https://www.greynoise.io/blog/stealthy-backdoor-campaign-affecting-asus-routers(Exploit, Third Party Advisory)
Weakness Type
CWE-78: OS Command Injection
CVE-2023-39780 is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS command injection. In the ASUS RT-AX55 firmware, the /start_apply.htm endpoint processes the qos_bw_rulelist parameter and incorporates its value into operating system commands without proper sanitization. An authenticated attacker can inject shell metacharacters to execute arbitrary commands on the underlying Linux-based router operating system.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
CVE-2023-39780 enables complete compromise of the ASUS RT-AX55 router with high impact across all CIA dimensions. The vulnerability is network-exploitable (AV:N) with low complexity (AC:L), requiring only low-level authentication (PR:L) and no user interaction (UI:N). Confidentiality (High): OS command injection grants access to all data on the router including WiFi passwords, VPN configurations, DHCP leases revealing all connected devices, stored credentials, and network traffic when combined with packet capture tools. Integrity (High): An attacker can modify router configurations, alter DNS settings to redirect traffic, install persistent backdoors, modify firmware, and create additional administrative accounts for persistent access. Availability (High): The attacker can disable the router, disrupt network services, or brick the device. The EPSS score of 42.66% at the 97.39th percentile indicates very high exploitation probability, consistent with reports of stealthy backdoor campaigns targeting ASUS routers.
Exploit Maturity
CVE-2023-39780 demonstrates very high exploit maturity with extensive public exploit availability. Public exploit code is available through multiple sources including detailed exploitation writeups at GitHub (D2y6p/CVE) covering at least six distinct exploitation variants. CISA has confirmed active exploitation by adding the vulnerability to the KEV catalog. The EPSS score of 42.66% at the 97.39th percentile places it among the top 2.6% of vulnerabilities by exploitation probability. GreyNoise has documented a stealthy backdoor campaign affecting ASUS routers that actively leverages this and related ASUS router vulnerabilities. The vulnerability description references related CVEs (CVE-2023-41345 through CVE-2023-41348) affecting similar code modules in the RT-AX55, suggesting a broader pattern of command injection across the firmware's web interface.
Remediation
-
Update firmware immediately on all ASUS RT-AX55 routers to a version that patches the command injection vulnerability in the QoS bandwidth rule processing. Check the ASUS support page for the latest firmware release.
-
Disable remote management (WAN access) on all affected routers to prevent exploitation from the internet. While the vulnerability requires authentication, compromised or weak credentials combined with internet exposure create an easily exploitable attack chain.
-
Change all router administrative credentials immediately, using strong, unique passwords. The vulnerability requires authenticated access, so strong credentials serve as a critical defense layer. Disable any guest or secondary accounts that are not strictly necessary.
-
Audit router configurations for indicators of compromise including unauthorized DNS server settings, unexpected port forwarding rules, modified firewall configurations, unknown administrative accounts, and any signs of persistent backdoors. GreyNoise has documented specific indicators associated with ASUS router backdoor campaigns.
-
Consider replacing the device if firmware updates are unavailable or if the device is approaching end-of-life. Implement network monitoring to detect command injection attempts and establish baseline traffic patterns to identify anomalous router behavior.
Technical Details
CVE-2023-39780 is an OS command injection vulnerability in the ASUS RT-AX55 firmware version 3.0.0.4.386.51598. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-accessible exploitation requiring low privileges with high impact across all dimensions. The vulnerability exists in the /start_apply.htm endpoint's handling of the qos_bw_rulelist parameter, which controls Quality of Service bandwidth rules. When an authenticated user submits QoS configuration changes, the router's web interface passes the qos_bw_rulelist value to operating system commands without sanitizing shell metacharacters. An attacker can inject command separators (such as semicolons or backticks) followed by arbitrary commands that execute with root privileges on the underlying Linux-based operating system. The vulnerability is one of several command injection flaws in the RT-AX55 firmware, with related vulnerabilities CVE-2023-41345 through CVE-2023-41348 affecting the token-generated module, token-refresh module, check token module, and code-authentication module respectively.
Frequently Asked Questions
Is CVE-2023-39780 being actively exploited?
Yes. CISA has confirmed active exploitation, and GreyNoise has documented stealthy backdoor campaigns targeting ASUS routers using this vulnerability. Public exploit code covering multiple exploitation variants is widely available on GitHub.
What products are affected by CVE-2023-39780?
ASUS RT-AX55 routers running firmware version 3.0.0.4.386.51598 are confirmed affected. Related command injection vulnerabilities (CVE-2023-41345 through CVE-2023-41348) affect similar code paths in the same firmware.
How do I fix CVE-2023-39780?
Update the RT-AX55 firmware to the latest patched version from ASUS. As immediate mitigations, disable remote WAN management, change administrative credentials to strong unique passwords, and audit the router configuration for signs of compromise.
How severe is CVE-2023-39780?
CVE-2023-39780 has a CVSS score of 8.8 (HIGH) and allows authenticated attackers to execute arbitrary OS commands with root privileges. The EPSS score of 42.66% at the 97.39th percentile indicates very high exploitation probability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.