ASUS RT-AX55 - RCE (CVE-2023-39780)
Description
On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar "token-generated module" issue, see CVE-2023-41345; for the similar "token-refresh module" issue, see CVE-2023-41346; for the similar "check token module" issue, see CVE-2023-41347; and for the similar "code-authentication module" issue, see CVE-2023-41348.
psychologyCrowdSec Analysis
CVE-2023-39780, a flaw in qos_bw_rulelist allows authenticated users to execute arbitrary system commands, leading to complete router takeover.
CrowdSec has been tracking this vulnerability and its exploits since 4th of June 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2023-39780 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Authenticated attackers inject OS commands via qos_bw_rulelist on /start_apply.htm, enabling full device compromise
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2023-09-11 |
| CISA KEV | 2025-06-02 |
| Rule Released | 2025-06-04 |
| CISA Remediation Deadline | 2025-06-23 |
| CrowdSec First Seen | 2025-09-04 |
Remediation & Protection
External References
- https://www.greynoise.io/blog/stealthy-backdoor-campaign-affecting-asus-routers
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/5/EN.md
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/3/EN.md
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/6/EN.md
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/2/EN.md
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/4/EN.md
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/1/EN.md