CVE-2022-26376
Critical
Description
A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.
SeverityCritical
CVSS9.8
Exploit probability—
ProductAsuswrt
PublishedAug 5, 2022
First seenAug 5, 2022
Weakness typeCWE-787Out-of-bounds write
How to fix
Update
- asus asuswrt3.0.0.4.386_48706 or later
- asuswrt-merlin new_gen386.7 or later
- asus xt8_firmware3.0.0.4.386_48706 or later
- asus tuf-ax3000_v2_firmware3.0.0.4.386_48750 or later
- asus xd4_firmware3.0.0.4.386_48790 or later
- asus et12_firmware3.0.0.4.386_48823 or later
- asus gt-ax6000_firmware3.0.0.4.386_48823 or later
- asus xt12_firmware3.0.0.4.386_48823 or later
- asus rt-ax58u_firmware3.0.0.4.386_48908 or later
- asus xt9_firmware3.0.0.4.388_20027 or later
- asus xd6_firmware3.0.0.4.386_49356 or later
- asus gt-ax11000_pro_firmware3.0.0.4.386_48996 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| asus asuswrt | v < 3.0.0.4.386_48706 | 3.0.0.4.386_48706 |
| asuswrt-merlin new_gen | v < 386.7 | 386.7 |
| asus xt8_firmware | v < 3.0.0.4.386_48706 | 3.0.0.4.386_48706 |
| asus tuf-ax3000_v2_firmware | v < 3.0.0.4.386_48750 | 3.0.0.4.386_48750 |
| asus xd4_firmware | v < 3.0.0.4.386_48790 | 3.0.0.4.386_48790 |
| asus et12_firmware | v < 3.0.0.4.386_48823 | 3.0.0.4.386_48823 |
| asus gt-ax6000_firmware | v < 3.0.0.4.386_48823 | 3.0.0.4.386_48823 |
| asus xt12_firmware | v < 3.0.0.4.386_48823 | 3.0.0.4.386_48823 |
| asus rt-ax58u_firmware | v < 3.0.0.4.386_48908 | 3.0.0.4.386_48908 |
| asus xt9_firmware | v < 3.0.0.4.388_20027 | 3.0.0.4.388_20027 |
| asus xd6_firmware | v < 3.0.0.4.386_49356 | 3.0.0.4.386_49356 |
| asus gt-ax11000_pro_firmware | v < 3.0.0.4.386_48996 | 3.0.0.4.386_48996 |
| asus gt-axe16000_firmware | v < 3.0.0.4.386_48786 | 3.0.0.4.386_48786 |
| asus rt-ax86u_firmware | v < 3.0.0.4.386_49447 | 3.0.0.4.386_49447 |
| asus rt-ax68u_firmware | v < 3.0.0.4.386_49479 | 3.0.0.4.386_49479 |
| asus rt-ax82u_firmware | v < 3.0.0.4.386_49380 | 3.0.0.4.386_49380 |
| asus rt-ax56u_firmware | v < 3.0.0.4.386_49559 | 3.0.0.4.386_49559 |
| asus rt-ax55_firmware | v < 3.0.0.4.386_49559 | 3.0.0.4.386_49559 |
| asus gt-ax11000_firmware | v < 3.0.0.4.386_49559 | 3.0.0.4.386_49559 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.