CVE-2022-26376: Critical severity asuswrt-merlin vulnerability

Q: What is CVE-2022-26376?

CVE-2022-26376 is a memory corruption vulnerability in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.

Q: How severe is CVE-2022-26376?

CVE-2022-26376 has a severity rating of 9.8 (critical).

Q: Which software versions are affected by CVE-2022-26376?

Asuswrt versions prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen versions prior to 386.7 are affected.

Q: Is my Asus Xt8 firmware vulnerable to CVE-2022-26376?

No, the Asus Xt8 firmware is not vulnerable to CVE-2022-26376.

Published Aug 5, 2022

Updated

A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.38648706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.

Affected Software

36 affected components

ASUS Asuswrt<3.0.0.4.386_48706

Asuswrt-Merlin New Gen<386.7

ASUS Xt8 Firmware<3.0.0.4.386_48706

ASUS Xt8

ASUS Tuf-ax3000 V2 Firmware<3.0.0.4.386_48750

ASUS Tuf-ax3000 V2

ASUS Xd4 Firmware<3.0.0.4.386_48790

ASUS Xd4

ASUS Et12 Firmware<3.0.0.4.386_48823

ASUS Et12

ASUS Gt-ax6000 Firmware<3.0.0.4.386_48823

ASUS Gt-ax6000

ASUS Xt12 Firmware<3.0.0.4.386_48823

ASUS Xt12

ASUS Rt-ax58u Firmware<3.0.0.4.386_48908

ASUS RT-AX58U

ASUS Xt9 Firmware<3.0.0.4.388_20027

ASUS Xt9

ASUS Xd6 Firmware<3.0.0.4.386_49356

ASUS Xd6

ASUS Gt-ax11000 Pro Firmware<3.0.0.4.386_48996

ASUS Gt-ax11000 Pro

ASUS Gt-axe16000 Firmware<3.0.0.4.386_48786

ASUS Gt-axe16000

ASUS Rt-ax86u Firmware<3.0.0.4.386_49447

ASUS RT-AX86U

ASUS Rt-ax68u Firmware<3.0.0.4.386_49479

ASUS RT-AX68U

ASUS Rt-ax82u Firmware<3.0.0.4.386_49380

ASUS RT-AX82U

ASUS Rt-ax56u Firmware<3.0.0.4.386_49559

ASUS RT-AX56U

ASUS Rt-ax55 Firmware<3.0.0.4.386_49559

ASUS RT-AX55

ASUS Gt-ax11000 Firmware<3.0.0.4.386_49559

ASUS GT-AX11000

Event History

Aug 5, 2022

CVE Published

via MITRE·09:18 PM

Data Sourced

via MITRE·09:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2022-26376?

CVE-2022-26376 is a memory corruption vulnerability in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.

How severe is CVE-2022-26376?

CVE-2022-26376 has a severity rating of 9.8 (critical).

Which software versions are affected by CVE-2022-26376?

Asuswrt versions prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen versions prior to 386.7 are affected.

How does CVE-2022-26376 work?

A specially-crafted HTTP request can lead to memory corruption, allowing an attacker to send a network request to exploit the vulnerability.

Is my Asus Xt8 firmware vulnerable to CVE-2022-26376?