CVE-2022-25596: ASUS RT-AC86U - Heap-based buffer overflow

Published Apr 7, 2022

Updated

ASUS RT-AC56U’s configuration function has a heap-based buffer overflow vulnerability due to insufficient validation for the decryption parameter length, which allows an unauthenticated LAN attacker to execute arbitrary code, perform arbitrary operations and disrupt service.

Affected Software

2 affected components

ASUS Rt-ac86u Firmware=3.0.0.4.386.45956

ASUS RT-AC86U

Remediation

Information

Update ASUS RT-AC86U firmware version to 3.0.0.4_386_46092

Event History

Apr 7, 2022

CVE Published

via MITRE·06:22 PM

Data Sourced

via MITRE·06:22 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this ASUS RT-AC56U vulnerability?

The vulnerability ID for this ASUS RT-AC56U vulnerability is CVE-2022-25596.

What is the severity of CVE-2022-25596?

The severity of CVE-2022-25596 is high with a CVSS score of 8.8.

How does this vulnerability in ASUS RT-AC56U occur?

This vulnerability in ASUS RT-AC56U occurs due to insufficient validation for the decryption parameter length, resulting in a heap-based buffer overflow.

What can an unauthenticated attacker do if they exploit this vulnerability?

An unauthenticated LAN attacker can execute arbitrary code, perform arbitrary operations, and disrupt service if they exploit this vulnerability.

Is ASUS RT-AC86U affected by this vulnerability?

No, ASUS RT-AC86U is not affected by this vulnerability.

Where can I find more information about this vulnerability?

You can find more information about this vulnerability at https://www.twcert.org.tw/tw/cp-132-5793-4f9d3-1.html