CVE-2023-34358

2023-07-3105:15:09

CWE-125

[email protected]

web.nvd.nist.gov

asus

rt-ax88u

httpd

unauthenticated

dos

vulnerability

cve-2023-34358

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

40.7%

JSON

ASUS RT-AX88U’s httpd is subject to an unauthenticated DoS condition. A remote attacker can send a specially crafted request to a device which contains a specific user agent, causing the httpd binary to crash during a string comparison performed within web.c, resulting in a DoS condition.

Affected configurations

NVD

Node

asusrt-ax88u_firmwareRange<3.0.0.4.388.23748

AND

asusrt-ax88uMatch-

CPENameOperatorVersion
asus:rt-ax88u_firmwareasus rt-ax88u firmwarelt3.0.0.4.388.23748

CPE	Name	Operator	Version
asus:rt-ax88u_firmware	asus rt-ax88u firmware	lt	3.0.0.4.388.23748

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "RT-AX88U",
    "vendor": "ASUS",
    "versions": [
      {
        "lessThanOrEqual": "3.0.0.4.388_22525-gd35b8fe",
        "status": "affected",
        "version": "  ",
        "versionType": "custom"
      }
    ]
  }
]