CVEvulnerability

CVE-2022-26376

9.8 CRITICAL Published 2022-08-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-08-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0 ([email protected])
5.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-787

Description

A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.

Affected configurations

• asus asuswrt (< 3.0.0.4.386 48706) • asuswrt-merlin new gen (< 386.7) • asus xt8 firmware (< 3.0.0.4.386 48706) • asus tuf-ax3000 v2 firmware (< 3.0.0.4.386 48750) • asus xd4 firmware (< 3.0.0.4.386 48790) • asus et12 firmware (< 3.0.0.4.386 48823) • asus gt-ax6000 firmware (< 3.0.0.4.386 48823) • asus xt12 firmware (< 3.0.0.4.386 48823) • asus rt-ax58u firmware (< 3.0.0.4.386 48908) • asus xt9 firmware (< 3.0.0.4.388 20027) • asus xd6 firmware (< 3.0.0.4.386 49356) • asus gt-ax11000 pro firmware (< 3.0.0.4.386 48996) • asus gt-axe16000 firmware (< 3.0.0.4.386 48786) • asus rt-ax86u firmware (< 3.0.0.4.386 49447) • asus rt-ax68u firmware (< 3.0.0.4.386 49479) • asus rt-ax82u firmware (< 3.0.0.4.386 49380) • asus rt-ax56u firmware (< 3.0.0.4.386 49559) • asus rt-ax55 firmware (< 3.0.0.4.386 49559) • asus gt-ax11000 firmware (< 3.0.0.4.386 49559)

Related

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References