CVE-2022-25596 ASUS RT-AC86U - Heap-based buffer overflow

ASUS RT-AC56U’s configuration function has a heap-based buffer overflow vulnerability due to insufficient validation for the decryption parameter length, which allows an unauthenticated LAN attacker to execute arbitrary code, perform arbitrary operations and disrupt service...

CVE-2022-25595 ASUS RT-AC86U - Improper Input Validation

ASUS RT-AC86U has improper user request handling, which allows an unauthenticated LAN attacker to cause a denial of service by sending particular request a server-to-client reply attempt...

CVE-2022-25595

The multiple connected records confirm CVE-2022-25595 affects ASUS RT-AC86U. The issue is an input/request handling validation error in the device, allowing an unauthenticated attacker on the same LAN (adjacent network) to trigger a denial of service by sending a particular server-to-client reply...

CVE-2022-23973 ASUS RT-AX56U - Stack overflew

ASUS RT-AX56U’s user profile configuration function is vulnerable to stack-based buffer overflow due to insufficient validation for parameter length. An unauthenticated LAN attacker can execute arbitrary code to perform arbitrary operations or disrupt service...

CVE-2022-23973

CVE-2022-23973 affects the ASUS RT-AX56U router. The vulnerability is a stack-based buffer overflow in the user profile configuration function caused by insufficient validation of parameter length. An unauthenticated attacker on the local network (LAN) can trigger arbitrary code execution or disr...

CVE-2022-23972

CVE-2022-23972 concerns the ASUS RT-AX56U router. The vulnerability is described as an SQL injection in the router’s SQL handling function caused by insufficient input validation. An unauthenticated attacker on the local network (LAN) can inject arbitrary SQL code to read, modify, and delete data...

CVE-2022-23972 ASUS RT-AX56U - SQL Injection

ASUS RT-AX56U’s SQL handling function has an SQL injection vulnerability due to insufficient user input validation. An unauthenticated LAN attacker to inject arbitrary SQL code to read, modify and delete database...

CVE-2022-23971

CVE-2022-23971 concerns ASUS RT-AX56U, where the update_PLC/PORT file path traversal arises from insufficient filtering of special URL characters. An unauthenticated attacker on the LAN can overwrite a system file by uploading another PLC/PORT file with the same name, leading to service disruptio...

CVE-2022-23971 ASUS RT-AX56U - Path Traversal

ASUS RT-AX56U’s updatePLC/PORT file has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated LAN attacker can overwrite a system file by uploading another PLC/PORT file with the same file name, which results in service...

CVE-2022-23970

The CVE-2022-23970 entry concerns the ASUS RT-AX56U router. A path traversal flaw exists in the update_json function due to insufficient filtering of special characters in the URL parameter. An unauthenticated LAN attacker can overwrite a system file by uploading another file with the same filena...

CVE-2022-23970 ASUS RT-AX56U - Path Traversal

ASUS RT-AX56U’s updatejson function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated LAN attacker can overwrite a system file by uploading another file with the same file name, which results in service disruption...

PT-2022-4546 · Asus · Asus Rt-Ac86U

Name of the Vulnerable Software and Affected Versions: ASUS RT-AC86U affected versions not specified Description: The issue arises from insufficient filtering for special characters in user requests to the LPD service, allowing an unauthenticated LAN attacker to perform a command injection attack...

CVE-2022-25595: Improper Input Validation

ASUS RT-AC86U has improper user request handling, which allows an unauthenticated LAN attacker to cause a denial of service by sending particular request a server-to-client reply attempt...

CVE-2022-23972: Improper Neutralization of Special Elements used in an SQL Command

ASUS RT-AX56U’s SQL handling function has an SQL injection vulnerability due to insufficient user input validation. An unauthenticated LAN attacker to inject arbitrary SQL code to read, modify and delete database...

CVE-2022-23970: Improper Limitation of a Pathname to a Restricted Directory

ASUS RT-AX56U’s updatejson function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated LAN attacker can overwrite a system file by uploading another file with the same file name, which results in service disruption...

CVE-2022-23973: Out-of-bounds Write

ASUS RT-AX56U’s user profile configuration function is vulnerable to stack-based buffer overflow due to insufficient validation for parameter length. An unauthenticated LAN attacker can execute arbitrary code to perform arbitrary operations or disrupt service...

CVE-2022-23971: Improper Limitation of a Pathname to a Restricted Directory

ASUS RT-AX56U’s updatePLC/PORT file has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated LAN attacker can overwrite a system file by uploading another PLC/PORT file with the same file name, which results in service...

CVE-2022-25596: Out-of-bounds Write

ASUS RT-AC56U’s configuration function has a heap-based buffer overflow vulnerability due to insufficient validation for the decryption parameter length, which allows an unauthenticated LAN attacker to execute arbitrary code, perform arbitrary operations and disrupt service...

ASUS RT-AX56U 路径遍历漏洞

The ASUS RT-AX56U is a wireless router from ASUS of Taiwan, China. A path traversal vulnerability exists in the ASUS RT-AX56U updatejson function due to insufficient filtering of special characters in URL parameters. An attacker can exploit the vulnerability to cause a service interruption by...

ASUS RT-AC56U 缓冲区错误漏洞

The ASUS RT-AC56U is a dual-band Wi-Fi router from ASUS China. A security vulnerability exists in the ASUS RT-AC56U, which originates from an insufficient validation of the decryption parameter length, and allows an attacker to execute arbitrary code, arbitrary operations, and interrupt services...