{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-11T10:11:14.680","vulnerabilities":[{"cve":{"id":"CVE-2023-39780","sourceIdentifier":"cve@mitre.org","published":"2023-09-11T19:15:43.190","lastModified":"2026-06-17T06:12:51.930","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar \"token-generated module\" issue, see CVE-2023-41345; for the similar \"token-refresh module\" issue, see CVE-2023-41346; for the similar \"check token module\" issue, see CVE-2023-41347; and for the similar \"code-authentication module\" issue, see CVE-2023-41348."},{"lang":"es","value":"Se descubrió que ASUS RT-AX55 v3.0.0.4.386.51598 contenía una vulnerabilidad de inyección de comandos autenticados."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"ASUS","product":"RT-AX55","defaultStatus":"unknown","versions":[{"version":"3.0.0.4.386.51598","versionType":"custom","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"asus","product":"rt-ax55","defaultStatus":"unknown","cpes":["cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:*"],"versions":[{"version":"3.0.0.4.386.51598","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-06-06T03:55:31.213801Z","id":"CVE-2023-39780","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"cisaExploitAdd":"2025-06-02","cisaActionDue":"2025-06-23","cisaRequiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cisaVulnerabilityName":"ASUS RT-AX55 Routers OS Command Injection Vulnerability","weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386.51598:*:*:*:*:*:*:*","matchCriteriaId":"0AABC778-3AC0-4730-953A-61175570FC81"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:*","matchCriteriaId":"B8F27D4F-EDC4-4676-8C66-545378850BF1"}]}]}],"references":[{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/1/EN.md","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/2/EN.md","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/3/EN.md","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/4/EN.md","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/5/EN.md","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/6/EN.md","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/1/EN.md","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/2/EN.md","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/3/EN.md","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/4/EN.md","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/5/EN.md","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/6/EN.md","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-39780","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]},{"url":"https://www.greynoise.io/blog/stealthy-backdoor-campaign-affecting-asus-routers","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"]}]}}]}