ASUS RT-AX88U - externally-controlled format string

Vulnerability

The ASUS RT-AX88U router contains an externally-controlled format string vulnerability in its Advanced Open VPN function. The flaw resides in how the device processes exported OpenVPN configuration files. Affected firmware versions are prior to 3.0.0.4_388_23748. An authenticated remote attacker can inject format string specifiers into the configuration, leading to unintended behavior [1].

Exploitation

An attacker must have valid authentication credentials to the router's management interface. By exporting the OpenVPN configuration and embedding format string tokens (e.g., %x, %n) into user-controlled fields, the attacker triggers the vulnerability when the device parses the configuration [1].

Impact

Successful exploitation can result in sensitive information leakage via memory read or cause the device to reset, leading to permanent denial of service. The CVSS score is 8.8 (High) with impacts on confidentiality, integrity, and availability [1].

Mitigation

ASUS has released firmware version 3.0.0.4_388_23748 to fix the vulnerability. Users should update immediately. No workarounds are provided, and the CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog [1].