CVE-2023-39780

ASUS RT-AX55 routers contain an OS command injection vulnerability (CWE-78) that allows a remote, authenticated attacker to execute arbitrary operating-system commands on the device. The flaw is triggered when an authenticated session submits crafted input that the router passes to its underlying OS without proper sanitization, though the available data does not identify the specific vulnerable parameter or affected firmware versions. Successful exploitation yields arbitrary command execution at the router's privilege level, which an attacker could use to change device configuration, establish persistence, or pivot into the networks behind the router. Any deployed ASUS RT-AX55 router is affected per CISA's listing, with the greatest risk on units whose management interface is reachable remotely. CISA added the issue to the Known Exploited Vulnerabilities catalog on 2025-06-02 (noting it as represented by CVE-2023-41346), confirming exploitation in the wild; EPSS currently estimates a 33.9% probability of exploitation within 30 days (98th percentile), no public PoC is known, and ransomware use is unknown.

What to do: Update RT-AX55 firmware to the latest release from ASUS, checking the vendor's security advisory for CVE-2023-39780 and the related CVE-2023-41346, as the available data does not specify a fixed version. Until patched, restrict administrative access (disable WAN-side/remote management if not needed), enforce strong administrator credentials, and review device settings for signs of tampering. Federal agencies should apply vendor mitigations per BOD 22-01 timelines or discontinue use of affected RT-AX55 routers if mitigations are unavailable.