Description

A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.

Related CPE's

o

asus

asuswrt

Vulnerable

o

asuswrt-merlin

new_gen

Vulnerable

o

asus

xt8_firmware

Vulnerable

h

asus

xt8

-

o

asus

tuf-ax3000_v2_firmware

Vulnerable

h

asus

tuf-ax3000_v2

-

o

asus

xd4_firmware

Vulnerable

h

asus

xd4

-

o

asus

et12_firmware

Vulnerable

h

asus

et12

-

o

asus

gt-ax6000_firmware

Vulnerable

h

asus

gt-ax6000

-

o

asus

xt12_firmware

Vulnerable

h

asus

xt12

-

o

asus

rt-ax58u_firmware

Vulnerable

h

asus

rt-ax58u

-

o

asus

xt9_firmware

Vulnerable

h

asus

xt9

-

o

asus

xd6_firmware

Vulnerable

h

asus

xd6

-

o

asus

gt-ax11000_pro_firmware

Vulnerable

h

asus

gt-ax11000_pro

-

o

asus

gt-axe16000_firmware

Vulnerable

h

asus

gt-axe16000

-

o

asus

rt-ax86u_firmware

Vulnerable

h

asus

rt-ax86u

-

o

asus

rt-ax68u_firmware

Vulnerable

h

asus

rt-ax68u

-

o

asus

rt-ax82u_firmware

Vulnerable

h

asus

rt-ax82u

-

o

asus

rt-ax56u_firmware

Vulnerable

h

asus

rt-ax56u

-

o

asus

rt-ax55_firmware

Vulnerable

h

asus

rt-ax55

-

o

asus

gt-ax11000_firmware

Vulnerable

h

asus

gt-ax11000

-

References

https://talosintelligence.com/vulnerability_reports/TALOS-2022-1511

ExploitThird Party Advisory

Weaknesses

[email protected]

Primary
CWE-787

[email protected]

Secondary
CWE-787

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 · Critical

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2022-08-05T22:15:11.143

2 years ago

Last modified

2022-12-02T20:08:05.937

2 years ago