CVE-2023-39780

What it actually does

CVE-2023-39780 is an authenticated OS command injection vulnerability in ASUS RT-AX55 firmware version 3.0.0.4.386.51598. A network-reachable attacker with valid low-privileged access to the router management interface can submit crafted input that is passed to an operating system shell without sufficient sanitization. Successful exploitation allows arbitrary command execution on the router, potentially with high privileges, enabling full compromise of the device, modification of configuration, traffic interception, malware deployment, persistence, and denial of service.

Why it matters to the business

Compromise of an edge router can disrupt internet connectivity, expose internal traffic, redirect users to malicious destinations, weaken perimeter controls, and provide attackers with a foothold into downstream networks. Because this vulnerability is in CISA KEV, has active in-the-wild exploitation, and has a remediation due date of 2025-06-23 for covered organizations, it should be treated as an urgent perimeter-device risk even though exploitation requires authentication. The affected product is a widely deployed consumer and small-office router, which increases the likelihood that unmanaged or forgotten devices remain exposed.

How an attack unfolds

An attacker first obtains access to the ASUS RT-AX55 management interface, commonly through reused credentials, default or weak passwords, exposed remote administration, credential theft, or prior compromise of a local device. After authentication, the attacker sends a crafted request to a vulnerable router function where a parameter is improperly incorporated into an OS command. By injecting shell metacharacters and commands, the attacker causes the router firmware to execute attacker-controlled commands. From there, the attacker can download and run malware, alter DNS or routing settings, create persistence through startup scripts or scheduled tasks, enable remote access, modify firewall and port-forwarding rules, capture or redirect traffic, or use the router as a staging point for attacks against internal systems. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, indicating real-world exploitation activity has been observed.

How to fix it

Upgrade affected ASUS RT-AX55 devices from firmware version 3.0.0.4.386.51598 to the latest firmware version available from ASUS. No specific fixed version was provided in the input, so administrators should consult ASUS support advisories and the official firmware download page for the RT-AX55 and apply the newest stable release. If immediate patching is not possible, disable remote administration from the internet, restrict management access to trusted internal IP addresses or a dedicated management network, change all router administrator credentials, remove unused accounts, disable unnecessary services, back up and review the configuration, and consider factory-resetting and reconfiguring any device suspected of compromise. Replace devices that cannot receive security updates.

How to confirm the fix worked

Confirm the router model and firmware version through the ASUS administration interface, device inventory, configuration backup, or authenticated network management tooling. Devices should no longer report firmware version 3.0.0.4.386.51598 after remediation. Verify that the management interface is not reachable from the public internet unless explicitly required and protected by strong access controls. Review the configuration for unexpected DNS servers, port forwards, firewall rules, VPN users, remote administration settings, and startup or scheduled commands. Where feasible, perform an authenticated vulnerability assessment or vendor-recommended validation check against a test device rather than attempting exploit payloads against production routers.

Typical attack path

1. Identify an internet-exposed or locally reachable ASUS RT-AX55 management interface.
2. Authenticate to the router using stolen, reused, default, weak, or otherwise compromised credentials.
3. Send a crafted authenticated HTTP request containing shell command injection syntax to the vulnerable firmware function.
4. Execute arbitrary operating system commands on the router.
5. Download tooling or malware using utilities such as wget, curl, tftp, or busybox where available.
6. Modify router configuration, DNS settings, firewall rules, port forwarding, or startup behavior for persistence and control.
7. Use the compromised router to intercept traffic, disrupt service, participate in botnet activity, or pivot toward internal network assets.

How to detect it

Investigate whether affected routers were exposed through remote administration and whether any suspicious authenticated management activity occurred before remediation. Useful sources include router syslog, web administration access logs if available, firewall logs, DNS resolver logs, DHCP logs, NetFlow or other network telemetry, configuration backups, and external attack-surface scans. Look for successful logins from unusual IP addresses, repeated authentication attempts, management requests containing encoded shell metacharacters, router-initiated outbound connections to unfamiliar hosts, downloads of binaries or scripts to temporary directories, unexplained reboots, new or modified DNS servers, unexpected port-forwarding or firewall rules, newly enabled remote administration, unknown VPN users, and traffic patterns consistent with botnet activity. Because many SOHO routers provide limited forensic logs, absence of logs does not prove absence of exploitation; suspicious configuration changes or unknown outbound connections should be treated seriously. If compromise is suspected, preserve configuration and available logs, disconnect the device from untrusted networks, factory-reset, upgrade firmware, and reconfigure from known-good settings rather than restoring a potentially compromised backup.

• ASUS RT-AX55
• 3.0.0.4.386.51598
• %3b
• %7c
• %60
• %24%28
• ;wget
• ; curl
• ;curl
• |wget
• | curl
• |curl
• tftp -g
• busybox wget
• chmod +x
• /tmp/
• /var/tmp/
• nvram set
• iptables -I
• iptables -A
• crontab -e
• /etc/init.d/

What your security team should do

• Prioritize identification and remediation of ASUS RT-AX55 devices because this vulnerability is in CISA KEV and has active exploitation in the wild.
• Upgrade all affected routers to the latest ASUS firmware; if no update is available, isolate or replace the device.
• Disable internet-facing remote administration and restrict management access to trusted networks only.
• Rotate router administrator credentials and remove unused or shared accounts.
• Review router configurations for unauthorized DNS, firewall, VPN, port-forwarding, and remote-access changes.
• Collect and retain router syslog, firewall, DNS, DHCP, and NetFlow records where available to support compromise assessment.
• Factory-reset and rebuild any router showing signs of unauthorized command execution, unexpected configuration changes, or unknown outbound connections.
• Monitor for exploitation patterns involving authenticated management requests followed by outbound downloads, unusual shell utilities, or configuration changes.
• For organizations subject to CISA BOD 22-01, remediate by the KEV due date of 2025-06-23 or earlier.