CVE-2023-39240: ASUS Rt-AC86U Firmware

High severity, CVSS 7.2. EPSS: 1.3% chance of exploitation in the next 30 days.

It is identified a format string vulnerability in ASUS RT-AX56U V2’s iperf client function API. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_cli.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.

Affected products

• ASUS Rt-AC86U Firmware: version 3.0.0.4_386_51529 only
• ASUS RT-AX55 Firmware: version 3.0.0.4.386_50460 only
• ASUS Rt-AX56U v2 Firmware: version 3.0.0.4.386_50460 only

Published 2023-09-07. Last modified 2026-06-17.