CVE-2022-26376

A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.
Configurations

Configuration 1 (hide)

cpe:2.3:o:asus:asuswrt:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:asuswrt-merlin:new_gen:*:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:asus:xt8_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:asus:xt8:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:asus:tuf-ax3000_v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:asus:tuf-ax3000_v2:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:asus:xd4_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:asus:xd4:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:asus:et12_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:asus:et12:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:asus:gt-ax6000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:asus:gt-ax6000:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:asus:xt12_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:asus:xt12:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:asus:rt-ax58u_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ax58u:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:asus:xt9_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:asus:xt9:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:asus:xd6_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:asus:xd6:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:asus:gt-ax11000_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:asus:gt-ax11000_pro:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:asus:gt-axe16000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:asus:gt-axe16000:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:asus:rt-ax86u_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ax86u:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:asus:rt-ax68u_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ax68u:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:asus:rt-ax82u_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ax82u:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:asus:rt-ax56u_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ax56u:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:asus:rt-ax55_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:*

Configuration 19 (hide)

AND
cpe:2.3:o:asus:gt-ax11000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:asus:gt-ax11000:-:*:*:*:*:*:*:*

History

21 Nov 2024, 06:53

Type Values Removed Values Added
References () https://talosintelligence.com/vulnerability_reports/TALOS-2022-1511 - Exploit, Third Party Advisory () https://talosintelligence.com/vulnerability_reports/TALOS-2022-1511 - Exploit, Third Party Advisory

Information

Published : 2022-08-05 22:15

Updated : 2024-11-21 06:53


NVD link : CVE-2022-26376

Mitre link : CVE-2022-26376

CVE.ORG link : CVE-2022-26376


JSON object : View

Products Affected

asus

  • xd6
  • rt-ax55_firmware
  • rt-ax68u
  • xt8
  • rt-ax68u_firmware
  • gt-ax6000
  • xt8_firmware
  • rt-ax82u
  • rt-ax82u_firmware
  • rt-ax56u_firmware
  • xd6_firmware
  • xt12
  • tuf-ax3000_v2
  • rt-ax58u
  • rt-ax86u
  • xt9
  • rt-ax56u
  • et12
  • xd4_firmware
  • gt-ax11000_firmware
  • gt-ax11000
  • rt-ax58u_firmware
  • xd4
  • tuf-ax3000_v2_firmware
  • asuswrt
  • xt9_firmware
  • et12_firmware
  • gt-axe16000_firmware
  • rt-ax86u_firmware
  • xt12_firmware
  • rt-ax55
  • gt-axe16000
  • gt-ax11000_pro
  • gt-ax6000_firmware
  • gt-ax11000_pro_firmware

asuswrt-merlin

  • new_gen
CWE
CWE-787

Out-of-bounds Write