ASUS RT-AX55、RT-AX56U_V2 - Format String - 1

Vulnerability

The set_iperf3_svr.cgi module in ASUS RT-AX55 (firmware version 3.0.0.4.386_50460) and RT-AX56U V2 (firmware version 3.0.0.4.386_50460) contains a format string vulnerability. The module fails to validate a specific input value, allowing an attacker to inject format specifiers. [1]

Exploitation

An attacker must have network access and valid administrator credentials to reach the vulnerable API. By sending a crafted request to set_iperf3_svr.cgi with malicious format string tokens, the attacker can trigger memory corruption and achieve code execution. [1]

Impact

Successful exploitation enables remote arbitrary code execution, arbitrary system operations, or denial of service. The attacker gains full control over the affected router, compromising confidentiality, integrity, and availability. [1]

Mitigation

ASUS has released fixed firmware versions: RT-AX55 update to 3.0.0.4.386_51948 and RT-AX56U V2 update to 3.0.0.4.386_51948. Users should apply the updates immediately. No workaround is available. [1]