ASUS Rt-AX56U v2 Firmware vulnerabilities

7 CVEs affecting ASUS Rt-AX56U v2 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-39240, published 2023-09-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-35086, published 2023-07-21. High severity, CVSS 7.2. EPSS: 38.5% chance of exploitation in the next 30 days. It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by directly using input as a format string when calling syslog in logmessage_normal…
CVE-2021-41435, published 2021-11-19. Critical severity, CVSS 9.8. EPSS: 6.5% chance of exploitation in the next 30 days. A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86…
CVE-2021-41436, published 2021-11-19. High severity, CVSS 7.5. EPSS: 5% chance of exploitation in the next 30 days. An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S),…
CVE-2023-39238, published 2023-09-07. High severity, CVSS 7.2. EPSS: 1.4% chance of exploitation in the next 30 days. It is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_svr.cgi module. A remote attacker…
CVE-2023-39240, published 2023-09-07. High severity, CVSS 7.2. EPSS: 1.3% chance of exploitation in the next 30 days. It is identified a format string vulnerability in ASUS RT-AX56U V2’s iperf client function API. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_cli.cgi…
CVE-2023-39239, published 2023-09-07. High severity, CVSS 7.2. EPSS: 1.3% chance of exploitation in the next 30 days. It is identified a format string vulnerability in ASUS RT-AX56U V2’s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. A…
CVE-2023-35087, published 2023-07-21. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by lacking validation for a specific value when calling cm_processChangedConfigMsg in…