CVE-2023-41345

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system, or terminate services.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Nov 3, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-413468.8ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh CVE-2023-413478.8ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its check token moCVE-2023-413488.8ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its code-authenticCVE-2023-413498.8ASUS router RT-AX88U has a vulnerability of using externally controllable format strings within its Advanced Open VPN function. An authenticCVE-2023-41356.5A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU. The QEMU process does not validate an offset provided byCVE-2023-413509.8Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient measures to prevent multiple failed authentication attempts. An unauthenCVE-2023-413519.8Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of authentication bypass, which allows an unauthenticated remote attacker to bypass the CVE-2023-413527.2Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilegeCVE-2023-413538.8Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of weak password requirements. A remote attacker with regular user privilege can easily CVE-2023-413545.3Chunghwa Telecom NOKIA G-040W-Q Firewall function does not block ICMP TIMESTAMP requests by default, an unauthenticated remote attacker can CVE-2023-413559.8Chunghwa Telecom NOKIA G-040W-Q Firewall function has a vulnerability of input validation for ICMP redirect messages. An unauthenticated remCVE-2023-413566.5NCSIST ManageEngine Mobile Device Manager(MDM) APP's special function has a path traversal vulnerability. An unauthenticated remote attacker
CVE-2023-41345: High severity, CVSS 8.8 | Vulnix