CVE-2023-41345 is a critical command injection vulnerability affecting ASUS RT-AX55 routers, stemming from insufficient filtering of special characters in its token-generated module. With a CVSS score of 8.8 (High), an authenticated remote attacker can easily exploit this flaw to execute arbitrary commands, disrupt the system, or terminate services. While no public exploit code exists in Metasploit, Nuclei, or ExploitDB, this vulnerability is linked to the "WrtHug" campaign, which has reportedly compromised thousands of ASUS routers, indicating active exploitation in the wild and significant community and media attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
3.0.0.4.386.51598CPE matchmatch criteria | cpe:2.3:o:asus:rt-ax55_firmware:3.0.0.4.386.51598:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.