CVE-2022-23971

published 2022-04-07

CVE-2022-23971: ASUS RT-AX56U’s update_PLC/PORT file has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An…

high 8.1 CVSS 3.1

AV A AC L PR N UI N S U C N I H A H

ASUS RT-AX56U’s update_PLC/PORT file has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated LAN attacker can overwrite a system file by uploading another PLC/PORT file with the same file name, which results in service disruption.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
asus	rt-ax56u	—	—
asus	rt-ax56u_firmware	—	—

CWE-22