CVE-2022-25597

CWE-78 — OS Command Injection3 documents3 sources
Severity
8.8HIGH
EPSS
0.2%
top 55.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Asus Rt-ac86uAsus Rt-ac86u Firmware
Timeline
PublishedApr 7
Latest updateApr 8

Description

ASUS RT-AC86U’s LPD service has insufficient filtering for special characters in the user request, which allows an unauthenticated LAN attacker to perform command injection attack, execute arbitrary commands and disrupt or terminate service.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5asus/rt-ac86u3.0.0.4.386.45956
▶NVDasus/rt-ac86u_firmware3.0.0.4.386.45956

🔴Vulnerability Details

2
GHSA
GHSA-xvrf-q22w-5f48: ASUS RT-AC86U’s LPD service has insufficient filtering for special characters in the user request, which allows an unauthenticated LAN attacker to per↗2022-04-08
▶
CVEList
ASUS RT-AC86U - Command Injection↗2022-04-07
▶