CVE-2023-38033CWE-78

ASUS RT-AC86U - Command injection vulnerability - 3

High · published September 7, 2023

CVSS v3.1
8.8
EPSS
1%
Percentile
72.0
In the wild
Unconfirmed
What it is

ASUS RT-AC86U unused Traffic Analyzer legacy Statistic function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01384 · 72.0th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2023-09-07T06:42Z
EPSS history
Timeline
  • 07 SEP 06:42Z
    ASUS RT-AC86U - Command injection vulnerability - 3
    cvelistv5