CVE-2023-41346: ASUS RT-AX55 - command injection - 2

Published Nov 3, 2023

Updated

ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services.

Affected Software

2 affected components

ASUS Rt-ax55 Firmware=3.0.0.4.386.51598

ASUS RT-AX55

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ASUS RT-AX55 to a version that resolves this vulnerability.
Fixed in 3.0.0.4.386_51948

Event History

Nov 3, 2023

CVE Published

via MITRE·04:21 AM

Data Sourced

via MITRE·04:21 AM

RemedyDescriptionSeverityWeakness

Jun 5, 2025

News Published

via ZDNet·01:26 PM

Oct 30, 2026

Exploit Published

via GitHub·05:06 PM

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2023-41346?

CVE-2023-41346 is a command injection vulnerability in ASUS RT-AX55 routers that allows an authenticated remote attacker to execute arbitrary commands.

How does CVE-2023-41346 affect ASUS RT-AX55 routers?

ASUS RT-AX55 routers with firmware version 3.0.0.4.386.51598 are vulnerable to CVE-2023-41346.

What is the severity of CVE-2023-41346?

CVE-2023-41346 has a severity score of 8.8 (high).

How can an attacker exploit CVE-2023-41346?

An authenticated remote attacker can exploit CVE-2023-41346 by injecting malicious commands into the ASUS RT-AX55 router to perform unauthorized actions.

Is ASUS RT-AX55 firmware version 3.0.0.4.386.51598 the only affected software?

Yes, ASUS RT-AX55 firmware version 3.0.0.4.386.51598 is the only affected software.