Important Photon OS Security Update - PHSA-2023-4.0-0474

Updates of 'linux-aws', 'linux-secure', 'linux-rt' packages of Photon OS have been released...

ASUS RT-AX55 Command Injection Vulnerability

The ASUS RT-AX55 is a dual-band Wi-Fi router from the Chinese company ASUS. A command injection vulnerability exists in ASUS RT-AX55 version v3.0.0.4.386.51598, which stems from the application failing to properly filter construct command special characters, commands, etc. An attacker can exploit...

AlmaLinux 9 : kernel-rt (ALSA-2023:5091)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:5091 advisory. - A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86 CPU Power management options...

ASUS RT-AX55 Command Injection

The vulnerability of ASUS RT-AX55 router’s microprogramming software is related to insufficient testing of the arguments passed in the command. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Important: Red Hat Security Advisory: kernel-rt security and bug fix update

An update for kernel-rt is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

RHEL 9 : kernel-rt (RHSA-2023:5091)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5091 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

CVE-2023-39780

On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /startapply.htm qosbwrulelist parameter. NOTE: for the similar "token-generated module" issue, see CVE-2023-41345; for the similar "token-refresh module" issue, see CVE-2023-41346; for the...

Command injection

ASUS RT-AX55 v3.0.0.4.386.51598 was discovered to contain an authenticated command injection vulnerability...

CVE-2023-39780

On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /startapply.htm qosbwrulelist parameter. NOTE: for the similar "token-generated module" issue, see CVE-2023-41345; for the similar "token-refresh module" issue, see CVE-2023-41346; for the...

CVE-2023-39780

On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /startapply.htm qosbwrulelist parameter. NOTE: for the similar "token-generated module" issue, see CVE-2023-41345; for the similar "token-refresh module" issue, see CVE-2023-41346; for the...

CVE-2023-39780: Improper Neutralization of Special Elements used in an OS Command

On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /startapply.htm qosbwrulelist parameter. NOTE: for the similar "token-generated module" issue, see CVE-2023-41345; for the similar "token-refresh module" issue, see CVE-2023-41346; for the...

PT-2023-4970

Name of the Vulnerable Software and Affected Versions ASUS RT-AX55 version 3.0.0.4.386.51598 Description The issue is related to an authenticated command injection vulnerability. This vulnerability allows a remote attacker to execute arbitrary system commands. Over 9,000 ASUS routers have been...

CVE-2023-39780

On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /startapply.htm qosbwrulelist parameter. NOTE: for the similar “token-generated module” issue, see CVE-2023-41345; for the similar “token-refresh module” issue, see CVE-2023-41346; for the...

CVE-2023-39780

CVE-2023-39780 affects ASUS RT‑AX55 devices (firmware 3.0.0.4.386.51598) where an authenticated attacker can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. The CVSSv3.1 base score is 8.8 (HIGH) with Network attack vector, Low attack complexity, Privileges Require...

Important Photon OS Security Update - PHSA-2023-5.0-0090

Updates of 'wireshark', 'linux', 'linux-rt' packages of Photon OS have been released...

CVE-2023-39239

It is identified a format string vulnerability in ASUS RT-AX56U V2’s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary...

CVE-2023-39238

It is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value within its setiperf3svr.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution,...

CVE-2023-39239

It is identified a format string vulnerability in ASUS RT-AX56U V2’s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary...

CVE-2023-39240

It is identified a format string vulnerability in ASUS RT-AX56U V2’s iperf client function API. This vulnerability is caused by lacking validation for a specific value within its setiperf3cli.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remo...

Format string

It is identified a format string vulnerability in ASUS RT-AX56U V2’s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. An unauthenticated remote attacker can exploit this vulnerability without privilege to perform remote...