CVE-2023-35086
ASUS RT-AX56U V2 & RT-AC86U - Format String -1
HIGH 7.2EPSS 38.5%
It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by directly using input as a format string when calling syslog in logmessage_normal function, in the do_detwan_cgi module of httpd. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.This issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529.
- Affected
- ASUS · RT-AX56U V2 · RT-AC86U
- CVSS v3.1 CERT
- 7.2 HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - EPSS
- 38.50% chance of exploitation in the next 30 days, 99th percentile
- Nuclei
- critical · CWE-134
- Published
- 2023-07-21
- Updated
- 2024-10-24
Proof-of-concept exploits (1)
- tin-z/CVE-2023-35086-POC44★ · 2023-07-25