CVE-2022-38105

CVE-2022-38105 affects Asus RT-AX82U (3.0.0.4.386_49674-ge182230). Talos singles out the cm_processREQ_NC information-disclosure vulnerability: a specially crafted network packet can leak sensitive data. The root cause involves the master_key handling in cm_processREQ_NC, where the code allocates...

CVE-2022-38105

An information disclosure vulnerability exists in the cmprocessREQNC opcode of Asus RT-AX82U 3.0.0.4.38649674-ge182230 router's configuration service. A specially-crafted network packets can lead to a disclosure of sensitive information. An attacker can send a network request to trigger this...

CVE-2022-38393

A denial of service vulnerability exists in the cfgserver cmprocessConnDiagPktList opcode of Asus RT-AX82U 3.0.0.4.38649674-ge182230 router's configuration service. A specially-crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this...

CVE-2022-38393

The CVE CVE-2022-38393 affects Asus RT-AX82U (firmware 3.0.0.4.386_49674-ge182230). TALOS documents a denial-of-service in the cfg_server cm_processConnDiagPktList opcode, caused by missing validation for UDP/TCP input length which allows an underflow of the datalen field, leading to a potential ...

CVE-2022-38393

A denial of service vulnerability exists in the cfgserver cmprocessConnDiagPktList opcode of Asus RT-AX82U 3.0.0.4.38649674-ge182230 router's configuration service. A specially-crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this...

Asus RT-AX82U cfg_server cm_processREQ_NC information disclosure vulnerability

Talos Vulnerability Report TALOS-2022-1590 Asus RT-AX82U cfgserver cmprocessREQNC information disclosure vulnerability January 10, 2023 CVE Number CVE-2022-38105 SUMMARY An information disclosure vulnerability exists in the cmprocessREQNC opcode of Asus RT-AX82U 3.0.0.4.38649674-ge182230 router’s...

Asus RT-AX82U get_IFTTTTtoken.cgi authentication bypass vulnerability

Talos Vulnerability Report TALOS-2022-1586 Asus RT-AX82U getIFTTTTtoken.cgi authentication bypass vulnerability January 10, 2023 CVE Number CVE-2022-35401 SUMMARY An authentication bypass vulnerability exists in the getIFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.38649674-ge182230. A...

CVE-2022-35401: Use of a Key Past its Expiration Date

An authentication bypass vulnerability exists in the getIFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.38649674-ge182230. A specially-crafted HTTP request can lead to full administrative access to the device. An attacker would need to send a series of HTTP requests to exploit this...

CVE-2022-38105: Improper Restriction of Operations within the Bounds of a Memory Buffer

An information disclosure vulnerability exists in the cmprocessREQNC opcode of Asus RT-AX82U 3.0.0.4.38649674-ge182230 router's configuration service. A specially-crafted network packets can lead to a disclosure of sensitive information. An attacker can send a network request to trigger this...

PT-2023-13603 · Asus · Asus Rt-Ax82U

Name of the Vulnerable Software and Affected Versions: Asus RT-AX82U version 3.0.0.4.386 49674-ge182230 Description: A denial of service issue exists in the cfg server cm processConnDiagPktList opcode of the router's configuration service. This can be triggered by a specially-crafted network...

PT-2023-13590 · Asus · Asus Rt-Ax82U

Name of the Vulnerable Software and Affected Versions: Asus RT-AX82U version 3.0.0.4.386 49674-ge182230 Description: An information disclosure issue exists in the cm processREQ NC opcode of the router's configuration service. A specially-crafted network packet can lead to a disclosure of sensitiv...

CVE-2022-38393: Out-of-bounds Read

A denial of service vulnerability exists in the cfgserver cmprocessConnDiagPktList opcode of Asus RT-AX82U 3.0.0.4.38649674-ge182230 router's configuration service. A specially-crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this...

PT-2022-6315 · Asus · Asus Rt-Ax82U

Name of the Vulnerable Software and Affected Versions: Asus RT-AX82U version 3.0.0.4.386 49674-ge182230 Description: An authentication bypass issue exists in the get IFTTTTtoken.cgi functionality, allowing a specially-crafted HTTP request to lead to full administrative access to the device. An...

CVE-2021-41435

CVE-2021-41435 affects a broad set of ASUS router models and TUF/ZenWiFi devices. The flaw is a brute-force protection bypass in the CAPTCHA protection that allows a remote attacker to perform an arbitrary number of login attempts by sending a specific HTTP request. Affected versions are before 3...

CVE-2021-41435: Improper Restriction of Excessive Authentication Attempts

A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56UV2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 SeriesRT-AX86U/RT-AX86S, RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400...

CVE-2021-41436: Inconsistent Interpretation of HTTP Requests

An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56UV2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 SeriesRT-AX86U/RT-AX86S, RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 TUF-AX5400, ASUS...