HighCISA KEVExploited in the wildPublic exploit

OS Command Injection in ASUS RT-AX55 /start_apply.htm qos_bw_rulelist

IdentifiersCVE-2023-39780CWE-78· Improper Neutralization of Special…

CVE-2023-39780 is an authenticated OS command injection vulnerability affecting ASUS RT-AX55 routers running firmware 3.0.0.4.386.51598. The issue is exposed through the /start_apply.htm endpoint, where the qos_bw_rulelist parameter is insufficiently sanitized, allowing an authenticated attacker to inject and execute arbitrary operating system commands on the device. The provided content consistently characterizes the flaw as a post-authentication command injection used to run arbitrary system-level commands on affected routers. The vulnerability has also been referenced by ASUS in related advisories covering similar token-module issues (CVE-2023-41345 through CVE-2023-41348).

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows execution of arbitrary system-level commands on the router with the privileges of the vulnerable web management process, enabling full device compromise in practice. Reported real-world abuse includes enabling SSH on a non-standard port, installing attacker-controlled SSH keys, disabling logging and AiProtection, modifying NVRAM-backed configuration for persistence across reboots and firmware upgrades, installing malicious software, and incorporating compromised routers into botnet or operational relay box infrastructure.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure by restricting or disabling remote administrative access, disabling unnecessary Internet-exposed features such as SSH, DDNS, AiCloud, and Web Access from WAN where operationally feasible, and limiting management access to trusted networks only. Monitor for indicators of compromise including unexpected SSH service on port 53282, unauthorized SSH public keys, disabled logging, and altered security settings such as AiProtection. Blocking known malicious source IPs mentioned in reporting may provide limited short-term risk reduction, but firmware update plus incident-response-driven cleanup remains necessary.

Remediation

Patch, then assume compromise.

Upgrade affected ASUS RT-AX55 devices to the vendor firmware release that addresses CVE-2023-39780. Because the content indicates attackers have used this flaw to establish persistence in NVRAM and install SSH backdoors that survive normal firmware upgrades, remediation of already-compromised devices requires more than patching alone: inspect SSH configuration, review authorized keys for unauthorized entries, check for SSH exposure on TCP port 53282, remove attacker-added configuration, rotate administrative credentials and SSH keys, and perform a full factory reset with manual reconfiguration if compromise is suspected.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

ASUSRt-Ax55hardware

ASUSRt-Ax55 Firmwareoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

26 SOURCESView more in app

the hacker newsNews

Nov 19, 2025

WrtHug Exploits Six ASUS WRT Flaws to Hijack Tens of Thousands of EoL Routers Worldwide

Unknown (vulnerability exploited by the AyySSHush/ViciousTrap botnet; mentioned as a shared/overlapping vulnerability with the WrtHug cluster).

bleeping computerNews

Nov 19, 2025

New WrtHug campaign hijacks thousands of end-of-life ASUS routers

Major command injection vulnerability in ASUS WRT routers, reported as used in both Operation WrtHug and the earlier AyySSHush campaign.

zdnet zero dayNews

Jun 5, 2025

Is your Asus router part of a botnet? How to check - and what you can do

A known Asus router vulnerability used post-compromise to run arbitrary system commands (command execution) on affected devices, enabling attackers to establish persistence (e.g., SSH access/backdoor).

cyberthroneNews

Jun 3, 2025

CISA Adds Five New Vulnerabilities to KEV Catalog

An OS command injection vulnerability in ASUS RT-AX55 routers that can enable remote code execution.

+5 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence2

Every observed campaign linking this CVE to a named adversary.

Associated malware6

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity15

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2023-39780

NVD

nvd.nist.gov/vuln/detail/CVE-2023-39780

MITRE CWE · CWE-78

Improper Neutralization of Special Elements…

Third Party Advisory

github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/1/EN.md

Third Party Advisory

github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/2/EN.md

Third Party Advisory

github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/3/EN.md

Third Party Advisory

github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/4/EN.md

Third Party Advisory

github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/5/EN.md

Third Party Advisory

github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/6/EN.md

Third Party Advisory

greynoise.io/blog/stealthy-backdoor-campaign-affecting-asus-routers

US Government Resource

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-39780