CVE-2022-23972: ASUS RT-AX56U - SQL Injection
Published Apr 7, 2022
·Updated
ASUS RT-AX56U’s SQL handling function has an SQL injection vulnerability due to insufficient user input validation. An unauthenticated LAN attacker to inject arbitrary SQL code to read, modify and delete database.
Affected Software
2 affected components
ASUS Rt-ax56u Firmware=3.0.0.4.386.45898
ASUS RT-AX56U
Remediation
Information
Update ASUS RT-AX56U firmware version to 3.0.0.4.386.45934
Event History
Apr 7, 2022
CVE Published
via MITRE·06:22 PM
Data Sourced
via MITRE·06:22 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2022-23972?
CVE-2022-23972 is a vulnerability that exists in the SQL handling function of ASUS RT-AX56U routers.
2
How does CVE-2022-23972 affect ASUS RT-AX56U routers?
CVE-2022-23972 allows an unauthenticated LAN attacker to inject arbitrary SQL code to read, modify, and delete the router's database.
3
Which version of ASUS RT-AX56U firmware is affected by CVE-2022-23972?
ASUS RT-AX56U firmware version 3.0.0.4.386.45898 is affected by CVE-2022-23972.
4
What is the severity of CVE-2022-23972?
The severity of CVE-2022-23972 is high, with a CVSS score of 8.8.
5
Is there a fix for CVE-2022-23972?
At the moment, there is no known fix for CVE-2022-23972. It is recommended to follow any security advisories provided by ASUS and apply patches when available.