CVE-2018-8877

Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acquire information on internal network IP address ranges by reading the newlanip variable on the errorpage.htm page...

CVE-2018-20335

An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can trigger a DoS of the httpd service via the /APPInstallation.asp?= URI...

CVE-2018-8878

Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acquire information on internal network devices' hostnames and MAC addresses by reading the customid variable on the blocking.asp...

CVE-2018-20336

An issue was discovered in ASUSWRT 3.0.0.4.384.20308. There is a stack-based buffer overflow issue in parsereqqueries function in wanduck.c via a long string over UDP, which may lead to an information leak...

CVE-2018-20334

An issue was discovered in ASUSWRT 3.0.0.4.384.20308. When processing the /startapply.htm POST data, there is a command injection issue via shell metacharacters in the fbemail parameter. By using this issue, an attacker can control the router and get shell...

CVE-2018-20333

An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can request /updateapplist.asp to see if a USB device is attached to the router and if there are apps installed on the router...

VulnCheck KEV: CVE-2018-20334

An issue was discovered in ASUSWRT 3.0.0.4.384.20308. When processing the /startapply.htm POST data, there is a command injection issue via shell metacharacters in the fbemail parameter. By using this issue, an attacker can control the router and get shell...

The vulnerability of the httpd function’s unescape function in the cgi.c file of the Asuswrt-Merlin New Gen microprogramming system allows a hacker to cause memory corruption.

The vulnerability of the unescape function in httpd’s cgi.c file of the Asuswrt-Merlin New Gen software relates to the escape operation going beyond buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause memory corruption by sending a specially crafted...

CVE-2022-26376

A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.38648706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability...

Memory corruption

A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.38648706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability...

CVE-2022-26376

A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.38648706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability...

CVE-2022-26376

A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.38648706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability...

CVE-2022-26376

CVE-2022-26376 affects Asuswrt and Asuswrt-Merlin New Gen. The vulnerability is a memory corruption in the httpd unescape function triggered by a crafted HTTP request; it arises due to missing bounds checking after a '%' character, potentially causing memory corruption or crashes via network inpu...

PT-2022-6671 · Asus · Asuswrt

Name of the Vulnerable Software and Affected Versions: Asuswrt versions prior to 3.0.0.4.386 48706 Asuswrt-Merlin New Gen versions prior to 386.7 Description: A memory corruption issue exists in the httpd unescape functionality. This can be triggered by a specially-crafted HTTP request, leading t...

ASUS Asuswrt-Merlin 缓冲区错误漏洞

ASUS Asuswrt-Merlin is a firmware from Asus Taiwan, China that runs in its routers. A buffer error vulnerability exists in ASUS Asuswrt-Merlin version 3.0.0.4.38648706 and Asuswrt-Merlin New Gen 386.1-beta1, which stems from a specially crafted HTTP request that could result in memory corruption...

Asuswrt and Asuswrt-Merlin New Gen httpd unescape memory corruption vulnerability

Talos Vulnerability Report TALOS-2022-1511 Asuswrt and Asuswrt-Merlin New Gen httpd unescape memory corruption vulnerability July 27, 2022 CVE Number CVE-2022-26376 SUMMARY A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.38648706 and...

CVE-2021-3229

Denial of service in ASUSWRT ASUS RT-AX3000 firmware versions 3.0.0.4.38410177 and earlier versions allows an attacker to disrupt the use of device setup services via continuous login error...

Denial of service

Denial of service in ASUSWRT ASUS RT-AX3000 firmware versions 3.0.0.4.38410177 and earlier versions allows an attacker to disrupt the use of device setup services via continuous login error...

CVE-2021-3229

CVE-2021-3229 affects ASUSWRT on ASUS RT-AX3000 firmware

CVE-2021-3229

Denial of service in ASUSWRT ASUS RT-AX3000 firmware versions 3.0.0.4.38410177 and earlier versions allows an attacker to disrupt the use of device setup services via continuous login error...