ASUS RT-AX88U - externally-controlled format string
CVE-2023-41349

8.8HIGH

Key Information:

Vendor
ASUS
Status
RT-AX88U
Vendor
CVE Published:
18 September 2023

Summary

The ASUS RT-AX88U router is susceptible to a format string vulnerability within its Advanced OpenVPN functionality. An authenticated remote attacker could exploit the router through the exported OpenVPN configuration, leading to potential information leakage or triggering a reset of the device. This could result in a permanent denial of service, compromising the device's reliability and performance. Users are advised to apply security patches and follow best practices to mitigate this risk.

Affected Version(s)

RT-AX88U < 3.0.0.4_388_23748

References

https://www.twcert.org.tw/tw/cp-132-7371-aecf1-1.html

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.