CVE-2023-35087
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
A format string vulnerability has been identified in ASUS RT-AX56U V2 and RT-AC86U. This issue is caused by lacking validation for a specific value when calling the cm_processChangedConfigMsg function in the AiMesh system.
Risk Assessment
An unauthenticated remote attacker can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation, or disrupt service.
Recommendation
It is recommended to update the firmware to the latest version to mitigate this vulnerability and implement additional security measures.
Original NVD description (English source)
It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by lacking validation for a specific value when calling cm_processChangedConfigMsg in ccm_processREQ_CHANGED_CONFIG function in AiMesh system. An unauthenticated remote attacker can exploit this vulnerability without privilege to perform remote arbitrary code execution, arbitrary system operation or disrupt service. This issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529.