CVE-2023-39780: OS Command Injection in ASUS RT-AX55

CVE-2023-39780 identifies an OS command injection vulnerability in ASUS RT-AX55 3.0.0.4.386.51598 via the qos_bw_rulelist parameter in /start_apply.htm. An authenticated attacker can execute arbitrary system commands, compromising the network device.

The vulnerability carries a CVSS score of 8.8, classified as HIGH severity. The flaw requires attacker authentication, which slightly reduces the attack vector compared to unauthenticated vulnerabilities. However, the NVD publication of September 11, 2023 has been followed on October 30, 2026 by GitHub signals declaring the public availability of exploits: a critical indicator that the vulnerability is actively interesting to attackers and that exploitation risk is concrete.

Defenders must prioritize inventory of ASUS RT-AX55 version 3.0.0.4.386.51598 devices in use in the corporate network. Contact ASUS support to verify the availability of corrective firmware and plan the update of affected devices. In the short term, restrict authenticated access to the router's administration service to authorized users and IP addresses only. Monitor system logs and network traffic to these devices for injection attempts and anomalous commands. Consider replacing devices no longer supported by the manufacturer.

ASUS has released similar security flaws during the same period: CVE-2023-41345 (token-generated module), CVE-2023-41346 (token-refresh module), CVE-2023-41347 (check token module), and CVE-2023-41348 (code-authentication module). This cluster of vulnerabilities suggests a broader issue in the RT-AX55 codebase and requires a comprehensive review of parameter validation mechanisms and authentication functions.