Is CVE-2023-39780 (ASUS RT-AX55 Routers OS Command Injection) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2023-39780 to its Known Exploited Vulnerabilities catalogue on 2 June 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. ASUS RT-AX55 devices contain an OS command injection vulnerability that could allow a remote, authenticated attacker to execute arbitrary commands.

How to confirm active exploitation and what “exploited in the wild” means

For this CVE, the practical question is not whether the flaw exists, but whether your specific ASUS RT-AX55 exposure overlaps with known active abuse. CISA placement in the KEV catalogue is the strongest operational signal that exploitation has been observed, so treat that as a trigger to verify inventory, internet exposure, and patch state rather than waiting for local alerts.

For a router vulnerability, confirmation starts with device ownership, firmware version, remote-management settings, and whether the device sits on any path that handles sensitive traffic. If you cannot immediately prove the device is patched or isolated, assume it deserves the same response priority as any other actively exploited edge-device issue. The CISA Known Exploited Vulnerabilities Catalog and the vendor advisory should be the first two references for authoritative status and remediation details.

Because the flaw is an OS command injection issue, the key operational question is whether an attacker can reach the vulnerable management surface and satisfy whatever authentication is required. Once that is possible, the router becomes a control plane problem, not just a patching problem, because command execution on network infrastructure can change DNS, routing, logging, or pivot paths.

Why a router command-injection flaw is more than a patching issue

Command injection on an edge router can be abused for direct device control, but the deeper risk is that the router often sits in a trusted position between users, internet services, and internal networks. That makes compromise useful for persistence, traffic manipulation, credential interception, or staging follow-on access into the environment.

Even when the vulnerability requires authentication, it can still be operationally severe if credentials are reused, weak, or already exposed elsewhere. In practice, this means the exploit value is not only in gaining shell-like command execution, but in using the device’s privileged network position to alter name resolution, forwarding behavior, or telemetry. The Web Application Attacks Guide is useful background for understanding how command injection turns a web-facing management interface into arbitrary command execution.

For edge appliances, active exploitation often matters more than the exact disclosure date because attackers can automate scanning and move quickly once a public exploit path exists. That is why KEV inclusion should drive urgent validation of exposure, even when the device is not yet known to be compromised.

What to do if you cannot patch immediately

If patching must wait, the goal is to reduce reachable attack surface and make any attempted abuse visible. Restrict management access to trusted admin networks, disable remote administration where it is not essential, and remove the device from direct internet exposure if the architecture allows it.

Next, look for signs that the router has already been used as an execution point: unexpected DNS changes, unfamiliar outbound connections, altered firewall rules, configuration drift, or unexplained restarts. For network appliances, compromise assessment is about configuration integrity and traffic behavior as much as about host logs, because logging on these devices is often limited. The Zero-Day and Exploited Vulnerabilities Guide is a practical reference for emergency prioritisation, mitigation, and post-patch hunting.

If the router is exposed in a home or small-office environment, a factory reset plus fresh credentialing may be warranted after remediation if there is any sign of manipulation. For business use, preserve a copy of the current configuration before changing it so you can compare settings, recover service safely, and support forensics.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Actively exploited CVEs require rapid identification and remediation of exposed assets.
Recommendation — Prioritise and remediate exposed devices using continuous vulnerability management.
NIST CSF 2.0	DE.CM-01 — Security Continuous Monitoring	Active exploitation requires monitoring for anomalous device and network behavior.
Recommendation — Monitor edge devices for configuration drift and suspicious outbound traffic.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This CVE demands prompt remediation of a known exploited flaw.
	CM-6 — Configuration Settings	Command injection on a router can alter privileged configuration and routing.
	AU-6 — Audit Record Review, Analysis, and Reporting	Investigating exploitation depends on reviewing logs and device activity for abuse.
Recommendation — Apply flaw remediation quickly and verify the vulnerable router is updated or replaced. Lock down and validate device configuration settings after remediation. Review available logs and alerts for signs of router abuse or tampering.

Practitioner Guidance

What to prioritise: Confirm whether the affected ASUS RT-AX55 is internet-reachable, whether remote management is enabled, and whether the vendor fix is applied. If any of those answers are unclear, treat the device as a high-priority exposure.

What to verify: Check DNS, WAN, admin accounts, scheduled tasks, forwarding rules, and firmware integrity before trusting the device again. Router compromise often shows up as control-plane drift rather than obvious endpoint malware.

Decision rule: If the router cannot be patched immediately, isolate it, reduce administrative access to the narrowest possible path, and assume compromise until you have checked for tampering. If business-critical traffic depends on it, plan a controlled replacement rather than a casual reboot-and-hope approach.

Practitioner takeaway: For an actively exploited router CVE, the correct response is to validate exposure first, then prove configuration integrity, because edge-device compromise can persist through the network role even when endpoint security tools see nothing.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org