CVE-2023-39240

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

It is identified a format string vulnerability in ASUS RT-AX56U V2’s iperf client function API. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_cli.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-134

Affected software

VendorProductVersions
ASUSRT-AX553.0.0.4.386_50460
ASUSRT-AX56U_V23.0.0.4.386_50460
asusrt-ax56u_v23.0.0.4.386.50460
asusrt-ax553.0.0.4.386_50460

References

Timeline

Published
Sep 7, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-392449.8DELL ESI (Enterprise Storage Integrator) for SAP LAMA, version 10.0, contains an information disclosure vulnerability in EHAC component. An CVE-2023-392459.8DELL ESI (Enterprise Storage Integrator) for SAP LAMA, version 10.0, contains an information disclosure vulnerability in EHAC component. An CVE-2023-392467.3Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server version prior to 11.8.1 contain an Insecure OpCVE-2023-392487.5Dell OS10 Networking Switches running 10.5.2.x and above contain an Uncontrolled Resource Consumption (Denial of Service) vulnerability, wheCVE-2023-392495.3Dell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass vulnerability that allows locally authenticated nonCVE-2023-392505.5Dell Storage Integration Tools for VMware (DSITV) and Dell Storage vSphere Client Plugin (DSVCP) versions prior to 6.1.1 and Replay Manager CVE-2023-392516.7Dell BIOS contains an Improper Input Validation vulnerability. A local malicious user with high privileges could potentially exploit this vuCVE-2023-392525.9Dell SCG Policy Manager 5.16.00.14 contains a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker may potentialCVE-2023-392537.8Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. A local authenticatedCVE-2023-392547.3Dell Update Package (DUP), Versions prior to 4.9.10 contain an Uncontrolled Search Path vulnerability. A malicious user with local access toCVE-2023-392567.8Dell Rugged Control Center, version prior to 4.7, contains an improper access control vulnerability. A local malicious standard user could pCVE-2023-392577.8Dell Rugged Control Center, version prior to 4.7, contains an Improper Access Control vulnerability. A local malicious standard user could p
CVE-2023-39240: High severity, CVSS 7.2 | Vulnix