CVE-2023-41346: Command Injection in ASUS RT-AX55

CVE-2023-41346 is a command injection vulnerability discovered in the authentication token-refresh module of ASUS RT-AX55 router. Insufficient filtering of special characters allows an already-authenticated attacker to inject arbitrary commands and compromise device operation. The router is a critical resource in many business and administration environments: access to system commands represents a high security risk for the entire network infrastructure.

The vulnerability has CVSS score 8.8, classified as High according to official data. It was published in NVD data on November 3, 2023. Recent signals (October 30, 2026) indicate that public repositories declare containing information related to this flaw, highlighting renewed technical interest in the security community. The status of patch availability is not confirmed in official data: it is essential to check directly the security advisories published by ASUS.

Sysadmins must immediately verify the firmware version number installed on the RT-AX55 model and consult official ASUS advisories to determine if a security update is available. A temporary mitigation consists of restricting remote access to the router's admin panel to known and trusted IP addresses. It is essential not to delay applying the patch once available, given the severity level of the vulnerability.