Back to KEVs

CVE-2023-39780

On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist...

Basic Information

CVE State
PUBLISHED
Reserved Date
August 07, 2023
Published Date
September 11, 2023
Last Updated
June 06, 2025
Vendor
ASUS
Product
RT-AX55
Description
On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar "token-generated module" issue, see CVE-2023-41345; for the similar "token-refresh module" issue, see CVE-2023-41346; for the similar "check token module" issue, see CVE-2023-41347; and for the similar "code-authentication module" issue, see CVE-2023-41348.
Tags
cisa edge

CVSS Scores

CVSS v3.1

8.8 - HIGH

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Score
51.22% (Percentile: 97.72%) as of 2025-06-14

SSVC Information

Exploitation
active
Technical Impact
total

Exploit Status

Exploited in the Wild
Yes (2025-05-28 00:00:00 UTC) Source
Seen in APT Campaigns
Yes (added 2025-03-17 00:00:00 UTC) Source

References

https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/1/EN.md https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/2/EN.md https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/3/EN.md https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/4/EN.md https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/5/EN.md https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/6/EN.md

Known Exploited Vulnerability Information

Source Added Date
GreyNoise 2025-05-28 00:00:00 UTC

Recent Mentions

CISA Adds Five Known Exploited Vulnerabilities to Catalog

Source: All CISA Advisories • Published: 2025-06-02 12:00:00 UTC

CISA added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2021-32030 ASUS Routers Improper Authentication Vulnerability CVE-2023-39780 ASUS RT-AX55 Routers OS Command Injection Vulnerability CVE-2024-56145 Craft CMS Code Injection Vulnerability CVE-2025-3935 ConnectWise ScreenConnect Improper Authentication Vulnerability CVE-2025-35939 Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. Please share your thoughts with us through our anonymous survey. We appreciate your feedback.

GreyNoise Discovers Stealthy Backdoor Campaign Affecting Thousands of ASUS Routers

Source: GreyNoise • Published: 2025-05-28 00:00:00 UTC

GreyNoise uncovers a stealth campaign exploiting ASUS routers, enabling persistent backdoor access via CVE-2023-39780 and unpatched techniques. Learn how attackers evade detection, how GreyNoise discovered it with AI-powered tooling, and what defenders need to know.

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Exploit Used in APT Campaign

  • Added to KEVIntel