PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-39780 ASUS CVE debrief

CVE-2023-39780 is an ASUS RT-AX55 router vulnerability described as an OS command injection issue and listed by CISA in the Known Exploited Vulnerabilities catalog. Because CISA marked it as known exploited, affected deployments should be treated as urgent even though the supplied corpus does not include firmware scope, authentication requirements, or exploit conditions.

Vendor
ASUS
Product
RT-AX55 Routers
CVSS
HIGH 8.8
CISA KEV
Listed
Original CVE published
2025-06-02
Original CVE updated
2025-06-02
Advisory published
2025-06-02
Advisory updated
2025-06-02

Who should care

Organizations and individuals operating ASUS RT-AX55 routers, especially administrators of internet-facing or remotely managed networks, should prioritize this issue. Managed service providers and security teams responsible for edge devices should also verify whether the model is deployed anywhere in their environment.

Technical summary

The supplied sources identify the issue as an OS command injection vulnerability in ASUS RT-AX55 routers. That classification indicates attacker-controlled input may be able to reach operating-system command execution paths. The provided corpus does not include the vulnerable interface, affected firmware versions, attack vector, or impact details beyond the vulnerability name and KEV listing.

Defensive priority

High

Recommended defensive actions

  • Check whether ASUS RT-AX55 routers are deployed in your environment and identify the installed firmware version.
  • Review ASUS product security advisory guidance and the RT-AX55 support/helpdesk page referenced by CISA for mitigation and firmware updates.
  • Apply vendor-provided mitigations or updates as soon as they are available.
  • If no effective mitigation is available for a deployed device, remove it from service or replace it.
  • Treat the device as a priority asset until you confirm it is remediated.

Evidence notes

Authoritative evidence comes from the CISA KEV catalog entry and its metadata, which names ASUS RT-AX55 Routers, classifies the issue as OS command injection, and sets dateAdded to 2025-06-02 with a due date of 2025-06-23. The corpus also references ASUS’s product security advisory and RT-AX55 support/helpdesk page, but their contents were not supplied here. No CVSS score was provided in the source material.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-39780 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-39780

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-39780 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-39780

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.