How severe is CVE-2023-39239?

CVE-2023-39239 has a CVSS 3.x base score of 7.2, rated high severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2023-39239 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (63rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-39239?

CVE-2023-39239 primarily affects Asus Rt-ax55 Firmware. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-39239?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2023-39239 published?

CVE-2023-39239 was published on 2023-09-07 and last updated on 2026-06-17.

CVE-2023-39239

CVE-2023-39239 is a high-severity vulnerability in Asus Rt-ax55 Firmware with a CVSS 3.x base score of 7.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-134.

Key facts

Severity: High (CVSS 3.x base score 7.2)
EPSS exploit prediction: 1% (63rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-134
Affected product: Asus Rt-ax55 Firmware
Published: 2023-09-07
Last modified: 2026-06-17

Description

It is identified a format string vulnerability in ASUS RT-AX56U V2’s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.

Frequently asked questions

What is CVE-2023-39239?: It is identified a format string vulnerability in ASUS RT-AX56U V2’s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.
How severe is CVE-2023-39239?: CVE-2023-39239 has a CVSS 3.x base score of 7.2, rated high severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2023-39239 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (63rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-39239?: CVE-2023-39239 primarily affects Asus Rt-ax55 Firmware. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-39239?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2023-39239 published?: CVE-2023-39239 was published on 2023-09-07 and last updated on 2026-06-17.

References

https://https://www.twcert.org.tw/tw/cp-132-7355-0ce8d-1.html

Affected products (3)

cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386_50460:*:*:*:*:*:*:*
cpe:2.3:o:asus:rt-ax56u_v2_firmware:3.0.0.4.386_50460:*:*:*:*:*:*:*
cpe:2.3:o:asus:rt-ac86u_firmware:3.0.0.4_386_51529:*:*:*:*:*:*:*

More vulnerabilities in Asus Rt-ax55 Firmware

CVE-2022-26376 — Critical (CVSS 9.8): A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and…
CVE-2021-41435 — Critical (CVSS 9.8): A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U,…
CVE-2021-43702 — Critical (CVSS 9.0): ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not…
CVE-2023-41348 — High (CVSS 8.8): ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters…
CVE-2023-41347 — High (CVSS 8.8): ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters…
CVE-2023-41346 — High (CVSS 8.8): ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters…

All CVEs affecting Asus Rt-ax55 Firmware →

Other CWE-134 vulnerabilities

CVE-2012-1851 — Critical (CVSS 10.0): Format string vulnerability in the Print Spooler service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2,…
CVE-2012-0242 — Critical (CVSS 10.0): Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary…
CVE-2011-2475 — Critical (CVSS 10.0): Format string vulnerability in ECTrace.dll in the iMailGateway service in the Internet Mail Gateway in OneBridge Server…
CVE-2011-1568 — Critical (CVSS 10.0): Format string vulnerability in the logText function in shmemmgr9.dll in IGSSdataServer.exe 9.00.00.11074, and…
CVE-2010-4235 — Critical (CVSS 10.0): Format string vulnerability in RealNetworks Helix Server 12.x, 13.x, and 14.x before 14.2, and Helix Mobile Server…
CVE-2011-0270 — Critical (CVSS 10.0): Format string vulnerability in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows…

Browse all CWE-134 vulnerabilities →