9.8

CVE-2022-26376

Exploit
A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Asus ≫ Asuswrt Version < 3.0.0.4.386_48706
Asuswrt-merlin ≫ New Gen Version < 386.7
Asus ≫ Xt8 Firmware Version < 3.0.0.4.386_48706
   Asus ≫ Xt8 Version -
Asus ≫ Tuf-ax3000 V2 Firmware Version < 3.0.0.4.386_48750
   Asus ≫ Tuf-ax3000 V2 Version -
Asus ≫ Xd4 Firmware Version < 3.0.0.4.386_48790
   Asus ≫ Xd4 Version -
Asus ≫ Et12 Firmware Version < 3.0.0.4.386_48823
   Asus ≫ Et12 Version -
Asus ≫ Gt-ax6000 Firmware Version < 3.0.0.4.386_48823
   Asus ≫ Gt-ax6000 Version -
Asus ≫ Xt12 Firmware Version < 3.0.0.4.386_48823
   Asus ≫ Xt12 Version -
Asus ≫ Rt-ax58u Firmware Version < 3.0.0.4.386_48908
   Asus ≫ Rt-ax58u Version -
Asus ≫ Xt9 Firmware Version < 3.0.0.4.388_20027
   Asus ≫ Xt9 Version -
Asus ≫ Xd6 Firmware Version < 3.0.0.4.386_49356
   Asus ≫ Xd6 Version -
Asus ≫ Gt-ax11000 Pro Firmware Version < 3.0.0.4.386_48996
   Asus ≫ Gt-ax11000 Pro Version -
Asus ≫ Gt-axe16000 Firmware Version < 3.0.0.4.386_48786
   Asus ≫ Gt-axe16000 Version -
Asus ≫ Rt-ax86u Firmware Version < 3.0.0.4.386_49447
   Asus ≫ Rt-ax86u Version -
Asus ≫ Rt-ax68u Firmware Version < 3.0.0.4.386_49479
   Asus ≫ Rt-ax68u Version -
Asus ≫ Rt-ax82u Firmware Version < 3.0.0.4.386_49380
   Asus ≫ Rt-ax82u Version -
Asus ≫ Rt-ax56u Firmware Version < 3.0.0.4.386_49559
   Asus ≫ Rt-ax56u Version -
Asus ≫ Rt-ax55 Firmware Version < 3.0.0.4.386_49559
   Asus ≫ Rt-ax55 Version -
Asus ≫ Gt-ax11000 Firmware Version < 3.0.0.4.386_49559
   Asus ≫ Gt-ax11000 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.31% 0.679
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Cisco Talos 5.3 3.9 1.4
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://talosintelligence.com/vulnerability_reports/TALOS-2022-1511
Third Party Advisory
Exploit