CVE-2022-26376

Published: Aug 5, 2022Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.

Affected (19)

Products: Asus: Asuswrt, Xt8 Firmware, Tuf Ax3000 V2 Firmware, Xd4 Firmware, Et12 Firmware, Gt Ax6000 Firmware, Xt12 Firmware, Rt Ax58u Firmware, Xt9 Firmware, Xd6 Firmware, Gt Ax11000 Pro Firmware, Gt Axe16000 Firmware, Rt Ax86u Firmware, Rt Ax68u Firmware, Rt Ax82u Firmware, Rt Ax56u Firmware, Rt Ax55 Firmware, Gt Ax11000 Firmware · Asuswrt Merlin: New Gen

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Asus Asuswrt	Before 3.0.0.4.386_48706

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Asuswrt Merlin New Gen	Before 386.7

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Xt8 Firmware	Before 3.0.0.4.386_48706

Running on/with	Platform Versions
Asus Xt8	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Tuf Ax3000 V2 Firmware	Before 3.0.0.4.386_48750

Running on/with	Platform Versions
Asus Tuf Ax3000 V2	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Xd4 Firmware	Before 3.0.0.4.386_48790

Running on/with	Platform Versions
Asus Xd4	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Et12 Firmware	Before 3.0.0.4.386_48823

Running on/with	Platform Versions
Asus Et12	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Gt Ax6000 Firmware	Before 3.0.0.4.386_48823

Running on/with	Platform Versions
Asus Gt Ax6000	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Xt12 Firmware	Before 3.0.0.4.386_48823

Running on/with	Platform Versions
Asus Xt12	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rt Ax58u Firmware	Before 3.0.0.4.386_48908

Running on/with	Platform Versions
Asus Rt Ax58u	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Xt9 Firmware	Before 3.0.0.4.388_20027

Running on/with	Platform Versions
Asus Xt9	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Xd6 Firmware	Before 3.0.0.4.386_49356

Running on/with	Platform Versions
Asus Xd6	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Gt Ax11000 Pro Firmware	Before 3.0.0.4.386_48996

Running on/with	Platform Versions
Asus Gt Ax11000 Pro	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Gt Axe16000 Firmware	Before 3.0.0.4.386_48786

Running on/with	Platform Versions
Asus Gt Axe16000	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rt Ax86u Firmware	Before 3.0.0.4.386_49447

Running on/with	Platform Versions
Asus Rt Ax86u	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rt Ax68u Firmware	Before 3.0.0.4.386_49479

Running on/with	Platform Versions
Asus Rt Ax68u	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rt Ax82u Firmware	Before 3.0.0.4.386_49380

Running on/with	Platform Versions
Asus Rt Ax82u	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rt Ax56u Firmware	Before 3.0.0.4.386_49559

Running on/with	Platform Versions
Asus Rt Ax56u	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Rt Ax55 Firmware	Before 3.0.0.4.386_49559

Running on/with	Platform Versions
Asus Rt Ax55	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Asus Gt Ax11000 Firmware	Before 3.0.0.4.386_49559

Running on/with	Platform Versions
Asus Gt Ax11000	All versions

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (2)

https://talosintelligence.com/vulnerability_reports/TALOS-2022-1511

Source: talos-cna@cisco.com

ExploitThird Party Advisory

https://talosintelligence.com/vulnerability_reports/TALOS-2022-1511

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.