CVE-2022-26376

CRITICAL

9.8

Description

A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published8/5/2022

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

asus:asuswrtasus:et12asus:et12_firmwareasus:gt-ax11000asus:gt-ax11000_firmwareasus:gt-ax11000_proasus:gt-ax11000_pro_firmwareasus:gt-ax6000asus:gt-ax6000_firmwareasus:gt-axe16000asus:gt-axe16000_firmwareasus:rt-ax55asus:rt-ax55_firmwareasus:rt-ax56uasus:rt-ax56u_firmwareasus:rt-ax58uasus:rt-ax58u_firmwareasus:rt-ax68uasus:rt-ax68u_firmwareasus:rt-ax82uasus:rt-ax82u_firmwareasus:rt-ax86uasus:rt-ax86u_firmwareasus:tuf-ax3000_v2asus:tuf-ax3000_v2_firmwareasus:xd4asus:xd4_firmwareasus:xd6asus:xd6_firmwareasus:xt12asus:xt12_firmwareasus:xt8asus:xt8_firmwareasus:xt9asus:xt9_firmwareasuswrt-merlin:new_gen

Weaknesses (CWE)

CWE-787CWE-787

References

https://talosintelligence.com/vulnerability_reports/TALOS-2022-1511(talos-cna@cisco.com)

https://talosintelligence.com/vulnerability_reports/TALOS-2022-1511(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.