CVE-2023-35086

🗓️ 21 Jul 2023 06:32:20Reported by twcertType

cve🔗 web.nvd.nist.gov👁 119 Views🌐 WEB

Format string vuln. in ASUS RT-AX56U V2 & RT-AC86U, allowing remote code execution

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for Use of Externally-Controlled Format String in Asus Rt-Ac86U_Firmware	25 Jul 202301:36	–	githubexploit
BDU FSTEC	ASUS RT-AC86U RT-AX56U Code Execution	2 Aug 202300:00	–	bdu_fstec
Circl	CVE-2023-35086	21 Jul 202312:33	–	circl
CNNVD	ASUS RT-AX56U: Format string error vulnerability	21 Jul 202300:00	–	cnnvd
Cvelist	CVE-2023-35086 ASUS RT-AX56U V2 & RT-AC86U - Format String -1	21 Jul 202306:32	–	cvelist
Kitploit	CVE-2023-35086-POC	27 Oct 202609:24	–	kitploit
NVD	CVE-2023-35086	21 Jul 202307:15	–	nvd
osv_cve	CVE-2023-35086	21 Jul 202307:15	–	osv_cve
Prion	Format string	21 Jul 202307:15	–	prion
Positive Technologies	PT-2023-4035 · Asus · Asus Rt-Ac86U +1	17 Jul 202300:00	–	ptsecurity

NVD

Vulners

Vulnrichment

Node

AND

asus rt-ac86u_firmwareMatch3.0.0.4_386_51529

asus rt-ac86uMatch-

Node

AND

asus rt-ax56u_v2_firmwareMatch3.0.0.4.386_50460

asus rt-ax56u_v2Match-

[
  {
    "defaultStatus": "unaffected",
    "product": "RT-AX56U V2",
    "vendor": "ASUS",
    "versions": [
      {
        "status": "affected",
        "version": "3.0.0.4.386_50460"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "RT-AC86U",
    "vendor": "ASUS",
    "versions": [
      {
        "status": "affected",
        "version": "3.0.0.4_386_51529"
      }
    ]
  }
]

Source	Link
twcert	www.twcert.org.tw/tw/cp-132-7240-a5f96-1.html

Parameter	Position	Path	Description	CWE
action_mode	query param	/detwan.cgi	Format string vulnerability in detwan.cgi's handling of action_mode that can lead to remote code execution.	CWE-134

17 Jun 2026 06:04Current

8.4High risk

Vulners AI Score8.4

CVSS 3.17.2

EPSS0.385

SSVC

CWE-134