{"id":"CVE-2023-39780","published":"2023-09-11T19:15:43Z","modified":"2026-06-17T06:12:51Z","title":"ASUS RT-AX55 Routers OS Command Injection Vulnerability","vendor":"ASUS","product":"RT-AX55 Routers","tier":"core","eol":null,"description":{"text":"On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar \"token-generated module\" issue, see CVE-2023-41345; for the similar \"token-refresh module\" issue, see CVE-2023-41346; for the similar \"check token module\" issue, see CVE-2023-41347; and for the similar \"code-authentication module\" issue, see CVE-2023-41348.","provenance":"source","from":"NVD"},"summary":{"text":"ASUS RT-AX55 routers running firmware 3.0.0.4.386.51598 contain an OS command injection flaw in the /start_apply.htm handler, where the qos_bw_rulelist parameter is not properly sanitised before being passed to the operating system. An attacker who can reach the device over the network and holds valid credentials can inject arbitrary operating system commands through this parameter, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:16Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.39514,"percentile":0.98611,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-06-02","dueDate":"2025-06-23","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.asus.com/networking-iot-servers/wifi-6/all-series/rt-ax55/helpdesk_bios/?model2Name=RT-AX55 ;   https://www.asus.com/content/asus-product-security-advisory/ ; https://nvd.nist.gov/vuln/detail/CVE-2023-39780","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-05-28","exploitedFirstSeen":"2025-05-28","ransomware":false,"evidence":[{"url":"https://www.greynoise.io/blog/stealthy-backdoor-campaign-affecting-asus-routers","date":"2025-05-28"},{"url":"https://www.labs.greynoise.io/grimoire/2025-03-28-ayysshush/","date":"2025-05-28"},{"url":"https://censys.com/blog/tracking-ayysshush-a-newly-discovered-asus-router-botnet-campaign","date":"2025-05-30"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-06-02"},{"url":"https://expel.com/blog/gonzo-threat-hunting-lapdogs-shortleash/","date":"2025-09-24"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2023-39780","date":"2025-11-23"},{"url":"https://securityscorecard.com/blog/operation-wrthug-exposed-the-router-hack-you-need-to-know/","date":"2025-12-10"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":8,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/1/EN.md","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/2/EN.md","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/3/EN.md","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/4/EN.md","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/5/EN.md","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/6/EN.md","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/1/EN.md","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/2/EN.md","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/3/EN.md","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/4/EN.md","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/5/EN.md","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/6/EN.md","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-39780","tags":["US Government Resource"]},{"url":"https://www.greynoise.io/blog/stealthy-backdoor-campaign-affecting-asus-routers","tags":["Exploit","Third Party Advisory"]}],"techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"exploitation_technique","evidence":[],"comment":"Attackers have gained access to affected ASUS routers by using brute-force login attempts and authentication bypasses, allowing them to inject and execute commands to enable SSH. Additionally, they can place a backdoor in the NVRAM.","confidence":"high"},{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"exploitation_technique","evidence":[],"comment":"Attackers have gained access to affected ASUS routers by using brute-force login attempts and authentication bypasses, allowing them to inject and execute commands to enable SSH. Additionally, they can place a backdoor in the NVRAM.","confidence":"high"},{"id":"T1588","name":"Obtain Capabilities","tactics":["resource-development"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"exploitation_technique","evidence":[],"comment":"Attackers have gained access to affected ASUS routers by using brute-force login attempts and authentication bypasses, allowing them to inject and execute commands to enable SSH. Additionally, they can place a backdoor in the NVRAM.","confidence":"high"},{"id":"T1059.004","name":"Unix Shell","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"primary_impact","evidence":[],"comment":"Attackers have gained access to affected ASUS routers by using brute-force login attempts and authentication bypasses, allowing them to inject and execute commands to enable SSH. Additionally, they can place a backdoor in the NVRAM.","confidence":"high"},{"id":"T1021.004","name":"SSH","tactics":["lateral-movement"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"secondary_impact","evidence":[],"comment":"Attackers have gained access to affected ASUS routers by using brute-force login attempts and authentication bypasses, allowing them to inject and execute commands to enable SSH. Additionally, they can place a backdoor in the NVRAM.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-43480","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-43480","exploited":true,"exploitedSince":"2025-06-02","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/1/EN.md","https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/2/EN.md","https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/3/EN.md","https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/4/EN.md","https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/5/EN.md","https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/6/EN.md","https://www.greynoise.io/blog/stealthy-backdoor-campaign-affecting-asus-routers"],"flow":[{"stage":"exploitation","techniques":["T1588","T1078","T1133"],"provenance":"source"},{"stage":"primary","techniques":["T1059.004"],"provenance":"source"},{"stage":"secondary","techniques":["T1021.004"],"provenance":"source"}],"timeline":[{"date":"2023-09-11","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39780","provenance":"source"},{"date":"2025-05-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.greynoise.io/blog/stealthy-backdoor-campaign-affecting-asus-routers","provenance":"source"},{"date":"2025-06-02","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-06-02","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-43480","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":630},"priority":{"score":68.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 521 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.72,"detail":"percentile 0.9861"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"7 NVD references tagged Exploit"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}