ASUS RT-AX55 - RCE (CVE-2023-39780)
0Exploiting IPs reported
On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar "token-generated module" issue, see CVE-2023-41345; for the similar "token-refresh module" issue, see CVE-2023-41346; for the similar "check token module" issue, see CVE-2023-41347; and for the similar "code-authentication module" issue, see CVE-2023-41348.
CrowdSec analysis
CVE-2023-39780, a flaw in qos_bw_rulelist allows authenticated users to execute arbitrary system commands, leading to complete router takeover.
CrowdSec has been tracking this vulnerability and its exploits since 4th of June 2025.
Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2023-39780 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance. CrowdSec data also reveals a clear uptick in attacks involving CVE-2023-39780 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.
Authenticated attackers inject OS commands via qos_bw_rulelist on /start_apply.htm, enabling full device compromise
Exploitation
Get real-time information about exploitation attempts and actors involved.
Common Weakness Enumeration (CWE)
Protection
Find out relevant information to protect your stack against this CVE.
Blocklist
With our advanced worldwide network detection, CrowdSec can provide a list of IPs known for exploiting the vulnerability.
To increase your protection against this CVE, block exploitation attempts with this list of identified actors.