CVE-2022-35401

An authentication bypass vulnerability exists in the getIFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.38649674-ge182230. A specially-crafted HTTP request can lead to full administrative access to the device. An attacker would need to send a series of HTTP requests to exploit this...

Information disclosure

An information disclosure vulnerability exists in the cmprocessREQNC opcode of Asus RT-AX82U 3.0.0.4.38649674-ge182230 router's configuration service. A specially-crafted network packets can lead to a disclosure of sensitive information. An attacker can send a network request to trigger this...

Authentication flaw

An authentication bypass vulnerability exists in the getIFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.38649674-ge182230. A specially-crafted HTTP request can lead to full administrative access to the device. An attacker would need to send a series of HTTP requests to exploit this...

Denial of service

A denial of service vulnerability exists in the cfgserver cmprocessConnDiagPktList opcode of Asus RT-AX82U 3.0.0.4.38649674-ge182230 router's configuration service. A specially-crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this...

CVE-2022-35401

Summary (CVE-2022-35401) : Talos reports an authentication bypass in Asus RT-AX82U (version 3.0.0.4.386_49674-ge182230) via the get_IFTTTTtoken.cgi endpoint. A remote attacker can obtain full administrative access by sending a series of HTTP requests. The exploit path relies on how the router han...

CVE-2022-35401

An authentication bypass vulnerability exists in the getIFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.38649674-ge182230. A specially-crafted HTTP request can lead to full administrative access to the device. An attacker would need to send a series of HTTP requests to exploit this...

CVE-2022-35401

An authentication bypass vulnerability exists in the getIFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.38649674-ge182230. A specially-crafted HTTP request can lead to full administrative access to the device. An attacker would need to send a series of HTTP requests to exploit this...

CVE-2022-38105

An information disclosure vulnerability exists in the cmprocessREQNC opcode of Asus RT-AX82U 3.0.0.4.38649674-ge182230 router's configuration service. A specially-crafted network packets can lead to a disclosure of sensitive information. An attacker can send a network request to trigger this...

CVE-2022-38105

CVE-2022-38105 affects Asus RT-AX82U (3.0.0.4.386_49674-ge182230). Talos singles out the cm_processREQ_NC information-disclosure vulnerability: a specially crafted network packet can leak sensitive data. The root cause involves the master_key handling in cm_processREQ_NC, where the code allocates...

CVE-2022-38105

An information disclosure vulnerability exists in the cmprocessREQNC opcode of Asus RT-AX82U 3.0.0.4.38649674-ge182230 router's configuration service. A specially-crafted network packets can lead to a disclosure of sensitive information. An attacker can send a network request to trigger this...

CVE-2022-38393

A denial of service vulnerability exists in the cfgserver cmprocessConnDiagPktList opcode of Asus RT-AX82U 3.0.0.4.38649674-ge182230 router's configuration service. A specially-crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this...

CVE-2022-38393

The CVE CVE-2022-38393 affects Asus RT-AX82U (firmware 3.0.0.4.386_49674-ge182230). TALOS documents a denial-of-service in the cfg_server cm_processConnDiagPktList opcode, caused by missing validation for UDP/TCP input length which allows an underflow of the datalen field, leading to a potential ...

CVE-2022-38393

A denial of service vulnerability exists in the cfgserver cmprocessConnDiagPktList opcode of Asus RT-AX82U 3.0.0.4.38649674-ge182230 router's configuration service. A specially-crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this...

Vulnerability Spotlight: Asus router access, information disclosure, denial of service vulnerabilities discovered

Lilith of Cisco Talos discovered these vulnerabilities. Cisco Talos recently discovered three vulnerabilities in Asus router software. The Asus RT-AX82U router is one of the newer Wi-Fi 6 802.11ax-enabled routers that also supports mesh networking with other Asus routers. Like other routers, it i...

Asus RT-AX82U cfg_server cm_processREQ_NC information disclosure vulnerability

Talos Vulnerability Report TALOS-2022-1590 Asus RT-AX82U cfgserver cmprocessREQNC information disclosure vulnerability January 10, 2023 CVE Number CVE-2022-38105 SUMMARY An information disclosure vulnerability exists in the cmprocessREQNC opcode of Asus RT-AX82U 3.0.0.4.38649674-ge182230 router’s...

Asus RT-AX82U get_IFTTTTtoken.cgi authentication bypass vulnerability

Talos Vulnerability Report TALOS-2022-1586 Asus RT-AX82U getIFTTTTtoken.cgi authentication bypass vulnerability January 10, 2023 CVE Number CVE-2022-35401 SUMMARY An authentication bypass vulnerability exists in the getIFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.38649674-ge182230. A...

ASUS RT-AX82U 缓冲区错误漏洞

The ASUS RT-AX82U is a wireless router from Asus China. A buffer error vulnerability exists in ASUS RT-AX82U version 3.0.0.4.38649674-ge182230, which stems from an information disclosure vulnerability in the cmprocessREQNC opcode of the router configuration service, where specially crafted networ...

ASUS RT-AX82U 授权问题漏洞

The ASUS RT-AX82U is a wireless router from the Chinese company ASUS. The ASUS RT-AX82U 3.0.0.4.38649674-ge182230 suffers from an authentication error vulnerability that stems from improper authentication in the getIFTTTtoken.cgi function. An attacker could use this vulnerability to access the...

PT-2023-13603 · Asus · Asus Rt-Ax82U

Name of the Vulnerable Software and Affected Versions: Asus RT-AX82U version 3.0.0.4.386 49674-ge182230 Description: A denial of service issue exists in the cfg server cm processConnDiagPktList opcode of the router's configuration service. This can be triggered by a specially-crafted network...

ASUS RT-AX82U 缓冲区错误漏洞

The ASUS RT-AX82U is a wireless router from the Chinese company ASUS. A denial of service vulnerability exists in ASUS RT-AX82U version 3.0.0.4.38649674-ge182230, which stems from improper input validation of the cfgserver cmprocessConnDiagPktList opcode of the router configuration service, which...