ASUS RT-AX56U V2 & RT-AC86U - Format String -1

Vulnerability

The httpd daemon's do_detwan_cgi module contains a format string vulnerability in the logmessage_normal function, which directly passes user-supplied input as the format string argument to syslog. This allows an attacker with administrator privileges to inject format specifiers. Affected firmware versions: RT-AX56U V2 3.0.0.4.386_50460 and RT-AC86U 3.0.0.4_386_51529. [1]

Exploitation

The attacker must have administrator credentials to access the web interface. By sending a crafted HTTP request to the vulnerable endpoint, the attacker can supply format string tokens (e.g., %x, %n) in the input. The logmessage_normal function then passes this input directly to syslog, allowing the attacker to read or write arbitrary memory locations. [1]

Impact

Successful exploitation enables remote arbitrary code execution with root privileges, arbitrary system operations, or denial of service. The attacker gains full control over the affected device. [1]

Mitigation

ASUS has released fixed firmware versions: RT-AX56U V2 update to 3.0.0.4_386_51598 and RT-AC86U update to 3.0.0.4.386_51915. No workarounds are documented, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog. [1]