CVE-2023-41349: ASUS RT-AX88U - externally-controlled format string

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-09-18 · updated 2026-06-17
Weakness: CWE-134

Description

ASUS router RT-AX88U has a vulnerability of using externally controllable format strings within its Advanced Open VPN function. An authenticated remote attacker can exploit the exported OpenVPN configuration to execute an externally-controlled format string attack, resulting in sensitivity information leakage, or forcing the device to reset and permanent denial of service.

Affected products

ASUS RT-AX88U: before 3.0.0.4.388.23748 — fixed in 3.0.0.4.388.23748

How to fix

Upgrade to a fixed version: ASUS RT-AX88U 3.0.0.4.388.23748. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-41349 or the next vulnerability affects your stack