CVE-2023-39780: ASUS RT-AX55 Router OS Command Injection via qos_bw_rulelist

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw allows authenticated remote command execution on an internet-facing edge device, has public exploit code, and is listed in CISA KEV with a near-term remediation deadline.

What it is

ASUS RT-AX55 firmware 3.0.0.4.386.51598 fails to sanitize the qos_bw_rulelist parameter on /start_apply.htm, allowing OS command injection. An attacker who already holds valid credentials can run arbitrary commands on the router, which is a network edge device.

Impact

An authenticated attacker gains arbitrary OS command execution on the router, enabling full device compromise, traffic interception, and use of the router as a foothold into the internal network.

Attack surface

Reached over the network via the web management interface at /start_apply.htm; the CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-privilege authentication is required and no user interaction is needed.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2025-06-02, and public exploit write-ups are referenced; EPSS gives a 30-day exploitation probability of about 40% (98.6th percentile).

What to do

• Update ASUS RT-AX55 firmware to a version that fixes the qos_bw_rulelist command injection; if no fixed version is available, discontinue use per CISA guidance.
• Restrict access to the router web management interface to trusted management networks only; never expose it to the internet.
• Change default and weak administrative credentials and enforce strong unique passwords for router logins.
• Monitor CISA KEV guidance and apply the vendor mitigation by the 2025-06-23 due date.

Detection

• Inspect router and web server logs for POST requests to /start_apply.htm containing qos_bw_rulelist values with shell metacharacters such as ;, |, $(), or backticks.
• Monitor for unexpected outbound connections or processes spawned by the router's web management service.
• Alert on authentication to the router admin interface from unusual source addresses or at unusual times, since exploitation requires valid credentials.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.