CVE-2023-39780

The vulnerability present in ASUS RT-AX55 devices stems from an OS command injection flaw that can be exploited through the qos_bw_rulelist parameter in the /start_apply.htm interface. This issue arises due to inadequate input validation, allowing authenticated attackers to manipulate system commands executed by the device. By crafting malicious input, an attacker can execute arbitrary commands on the underlying operating system, potentially leading to unauthorized access or control over the device. The severity of this vulnerability is underscored by its high CVSS score of 8.8, indicating a significant risk to affected systems.

Attack vectors for this vulnerability primarily involve authenticated users who have access to the device's web interface. Once an attacker gains legitimate credentials, they can exploit the command injection flaw by sending specially crafted requests to the vulnerable parameter. This could be achieved through various means, such as phishing attacks to obtain user credentials or exploiting weak passwords. Once inside, the attacker could execute commands that may allow them to alter device configurations, extract sensitive data, or even pivot to other devices within the network. The potential for lateral movement within a network makes this vulnerability particularly concerning, as it could lead to broader attacks against other connected systems.

The real-world impact of this vulnerability can be substantial, especially for organizations that rely on ASUS RT-AX55 devices for their networking infrastructure. Successful exploitation could result in unauthorized access to sensitive information, disruption of network services, and potential data breaches. Businesses may face significant financial losses due to operational downtime, reputational damage, and regulatory penalties if sensitive data is compromised. Moreover, the interconnected nature of modern networks means that a breach in one device can have cascading effects, impacting multiple systems and leading to a more extensive compromise.

To detect and mitigate this vulnerability, organizations should implement a multi-layered security approach. Regularly updating firmware to the latest versions is crucial, as vendors often release patches to address known vulnerabilities. Network monitoring tools can be employed to detect unusual traffic patterns or unauthorized access attempts, providing early warning signs of potential exploitation. Additionally, organizations should enforce strong authentication mechanisms, such as multi-factor authentication, to reduce the risk of unauthorized access. Conducting regular security audits and penetration testing can also help identify and remediate vulnerabilities before they can be exploited by malicious actors.

In conclusion, the OS command injection vulnerability in ASUS RT-AX55 devices presents a serious threat to both individual users and organizations. The ability for authenticated attackers to execute arbitrary commands can lead to significant security breaches and operational disruptions. By understanding the technical details, potential attack vectors, and real-world implications, organizations can better prepare themselves to defend against such vulnerabilities. Implementing robust detection and mitigation strategies will be essential in safeguarding network infrastructure and maintaining the integrity of sensitive data.

CSURFACE threat intelligence has identified a moderate increase in the Exploit Prediction Scoring System (EPSS) score for CVE-2023-39780, rising by over 10% to nearly 0.47. This upward trend, while not classified as rapid, indicates growing confidence in the likelihood of exploitation attempts against ASUS RT-AX55 devices. Although no new exploit techniques or ransomware affiliations have been detected by our sensors, the inclusion of this vulnerability in the Known Exploited Vulnerabilities (KEV) catalog underscores its elevated priority for defenders. The heightened EPSS score suggests that threat actors may be increasingly targeting this OS command injection flaw, potentially leveraging authenticated access to execute malicious commands. Consequently, the risk level for organizations using affected devices should be considered elevated, warranting closer monitoring and prioritization within vulnerability management programs.

Update 2 — July 17, 2026

CSURFACE threat intelligence has identified a notable surge in detection activity related to CVE-2023-39780, reflecting an increased adversary focus on this authenticated OS command injection vulnerability in ASUS RT-AX55 devices. This uptick corresponds with a modest rise in the EPSS score, signaling a growing likelihood of exploitation attempts in operational environments. Although no new exploit techniques or ransomware affiliations have been observed, the vulnerability’s recent inclusion in the Known Exploited Vulnerabilities catalog further elevates its priority for defensive measures. The trend suggests that threat actors may be intensifying reconnaissance and preparatory actions, potentially increasing the risk of successful exploitation where authenticated access is obtained. Consequently, the threat level for affected organizations should be considered heightened, warranting enhanced vigilance in monitoring and response activities.

Update 3 — August 05, 2026

CSURFACE threat intelligence has identified a marked escalation in detection activity related to CVE-2023-39780, indicating increased adversary interest or reconnaissance efforts targeting ASUS RT-AX55 devices. This uptick in telemetry corresponds with a slight rise in the EPSS score, reflecting a growing likelihood of exploitation attempts in the near term. Although no new exploit techniques or ransomware affiliations have been observed, the vulnerability’s recent addition to the Known Exploited Vulnerabilities catalog underscores its elevated priority within the threat landscape. For defenders, this trend signals a heightened risk environment where authenticated attackers may be more actively probing or preparing to leverage the OS command injection vector. Consequently, the threat level should be considered elevated, warranting increased monitoring and readiness to detect potential exploitation attempts.