CVE-2023-35086
HighCVSS 7.2Exploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
A format string vulnerability has been identified in ASUS RT-AX56U V2 and RT-AC86U. This issue is caused by directly using input as a format string when calling syslog in the logmessage_normal function of the do_detwan_cgi module.
Risk Assessment
A remote attacker with administrator privileges can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation, or disrupt service.
Recommendation
It is recommended to update the firmware to the latest version to mitigate this vulnerability and restrict access to the device's administrative interface.
Original NVD description (English source)
It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by directly using input as a format string when calling syslog in logmessage_normal function, in the do_detwan_cgi module of httpd. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service. This issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529.