CVE-2022-26376
A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Modified - talos-cna@cisco.com
- Published
- 2022-08-05
- Last modified
- 2025-04-15
- Weaknesses
- CWE-787
Affected products
- Asuswrt (Asus)
- Et12 Firmware (Asus)
- Gt-ax11000 Firmware (Asus)
- Gt-ax11000 Pro Firmware (Asus)
- Gt-ax6000 Firmware (Asus)
- Gt-axe16000 Firmware (Asus)
- Rt-ax55 Firmware (Asus)
- Rt-ax56u Firmware (Asus)
- Rt-ax58u Firmware (Asus)
- Rt-ax68u Firmware (Asus)
- Rt-ax82u Firmware (Asus)
- Rt-ax86u Firmware (Asus)
- Tuf-ax3000 V2 Firmware (Asus)
- Xd4 Firmware (Asus)
- Xd6 Firmware (Asus)
- Xt12 Firmware (Asus)
- Xt8 Firmware (Asus)
- Xt9 Firmware (Asus)
- Asuswrt-merlin New Gen (Asuswrt-merlin)
- New Gen (Asuswrt-merlin)
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1511
