CVE-2023-35086

🗓️ 21 Jul 2023 06:32:20Reported by twcertType

cve🔗 web.nvd.nist.gov👁 89 Views🌐 WEB

Format string vuln. in ASUS RT-AX56U V2 & RT-AC86U, allowing remote code execution

Reporter	Title	Published	Views	Family All 10
GithubExploit	Exploit for Use of Externally-Controlled Format String in Asus Rt-Ac86U_Firmware	25 Jul 202301:36	–	githubexploit
BDU FSTEC	The vulnerability of the microprogrammed software of Wi-Fi routers ASUS RT-AC86U and RT-AX56U allows a hacker to execute arbitrary code.	2 Aug 202300:00	–	bdu_fstec
Circl	CVE-2023-35086	21 Jul 202312:33	–	circl
CNNVD	ASUS RT-AX56U 格式化字符串错误漏洞	21 Jul 202300:00	–	cnnvd
Cvelist	CVE-2023-35086 ASUS RT-AX56U V2 & RT-AC86U - Format String -1	21 Jul 202306:32	–	cvelist
NVD	CVE-2023-35086	21 Jul 202307:15	–	nvd
OSV	CVE-2023-35086	21 Jul 202307:15	–	osv
Prion	Format string	21 Jul 202307:15	–	prion
Positive Technologies	PT-2023-4035 · Asus · Asus Rt-Ac86U +1	17 Jul 202300:00	–	ptsecurity
Vulnrichment	CVE-2023-35086 ASUS RT-AX56U V2 & RT-AC86U - Format String -1	21 Jul 202306:32	–	vulnrichment

NVD

Vulners

Vulnrichment

Node

asus rt-ac86u_firmwareMatch3.0.0.4_386_51529

AND

asus rt-ac86uMatch-

Node

asus rt-ax56u_v2_firmwareMatch3.0.0.4.386_50460

AND

asus rt-ax56u_v2Match-

[
  {
    "defaultStatus": "unaffected",
    "product": "RT-AX56U V2",
    "vendor": "ASUS",
    "versions": [
      {
        "status": "affected",
        "version": "3.0.0.4.386_50460"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "RT-AC86U",
    "vendor": "ASUS",
    "versions": [
      {
        "status": "affected",
        "version": "3.0.0.4_386_51529"
      }
    ]
  }
]

Source	Link
twcert	www.twcert.org.tw/tw/cp-132-7240-a5f96-1.html

Parameter	Position	Path	Description	CWE
action_mode	query param	/detwan.cgi	Format string vulnerability in detwan.cgi via action_mode parameter leading to potential RCE/DoS.	CWE-134

17 Jun 2026 06:04Current

7.3High risk

Vulners AI Score7.3

CVSS 3.17.2

EPSS0.39705

SSVC

CWE-134