CVE-2022-26376
published 2022-08-05CVE-2022-26376: A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.…
PriorityP352critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.12%
62.4th percentile
A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| asus | asuswrt | < 3.0.0.4.386_48706 | 3.0.0.4.386_48706 |
| asus | et12_firmware | < 3.0.0.4.386_48823 | 3.0.0.4.386_48823 |
| asus | gt-ax11000_firmware | < 3.0.0.4.386_49559 | 3.0.0.4.386_49559 |
| asus | gt-ax11000_pro_firmware | < 3.0.0.4.386_48996 | 3.0.0.4.386_48996 |
| asus | gt-ax6000_firmware | < 3.0.0.4.386_48823 | 3.0.0.4.386_48823 |
| asus | gt-axe16000_firmware | < 3.0.0.4.386_48786 | 3.0.0.4.386_48786 |
| asus | rt-ax55_firmware | < 3.0.0.4.386_49559 | 3.0.0.4.386_49559 |
| asus | rt-ax56u_firmware | < 3.0.0.4.386_49559 | 3.0.0.4.386_49559 |
| asus | rt-ax58u_firmware | < 3.0.0.4.386_48908 | 3.0.0.4.386_48908 |
| asus | rt-ax68u_firmware | < 3.0.0.4.386_49479 | 3.0.0.4.386_49479 |
| asus | rt-ax82u_firmware | < 3.0.0.4.386_49380 | 3.0.0.4.386_49380 |
| asus | rt-ax86u_firmware | < 3.0.0.4.386_49447 | 3.0.0.4.386_49447 |
| asus | tuf-ax3000_v2_firmware | < 3.0.0.4.386_48750 | 3.0.0.4.386_48750 |
| asus | xd4_firmware | < 3.0.0.4.386_48790 | 3.0.0.4.386_48790 |
| asus | xd6_firmware | < 3.0.0.4.386_49356 | 3.0.0.4.386_49356 |
| asus | xt12_firmware | < 3.0.0.4.386_48823 | 3.0.0.4.386_48823 |
| asus | xt8_firmware | < 3.0.0.4.386_48706 | 3.0.0.4.386_48706 |
| asus | xt9_firmware | < 3.0.0.4.388_20027 | 3.0.0.4.388_20027 |
| asuswrt-merlin | asuswrt-merlin_new_gen | — | — |
| asuswrt-merlin | new_gen | < 386.7 | 386.7 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Talos
The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter
blogs_talos·2023-08-02
The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter
## The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter
Since the discovery of the widespread VPNFilter malware in 2018 , Cisco Talos researchers have been researching vulnerabilities in small and home office (SOHO) and industrial routers.
During that research, Talos has worked with vendors to report and mitigate these vulnerabilities, totaling 141 advisories covering 289 CVEs across multiple routers.
Talos is highlighting some of the major issues our researchers discovered over the past several years, including vulnerabilities that an attacker could mostly directly access or those an adversary could chain together to gain elevated access to the devices.
There are several Snort rules that can detect possible exploitation of the vulnerabilitie
Talos
The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter
blogs_talos·2023-08-02
The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter
- Since the discovery of the widespread VPNFilter malware in 2018, Cisco Talos researchers have been researching vulnerabilities in small and home office (SOHO) and industrial routers.
- During that research, Talos has worked with vendors to report and mitigate these vulnerabilities, totaling 141 advisories covering 289 CVEs across multiple routers.
- Talos is highlighting some of the major issues our researchers discovered over the past several years, including vulnerabilities that an attacker could mostly directly access or those an adversary could chain together to gain elevated access to the devices.
- There are several Snort rules that can detect possible exploitation of the vulnerabilities included in this post.
Small office/home office (SOHO) routers and small-scale industrial rout
Talos
Vulnerability Spotlight: How a code re-use issue led to vulnerabilities across multiple products
blogs_talos·2022-07-27
Vulnerability Spotlight: How a code re-use issue led to vulnerabilities across multiple products
Recently, I was performing some research on a wireless router and noticed the following piece of code:
This unescape function will revert the URL encoded bytes to its original form. But something specifically caught my attention: There was no size check for the performed operations and the function assumes that after a ‘%’ there are always two bytes. So, what would happen if after ‘%’, only one character existed? The answer is that the s+3, in the strcpy, will access after the end of the string. So, it could lead to memory corruption. Then, I tried to exploit this bug on the router in question. But based on how the URL string was managed in that device, it was not possible. But it had the potential to crash other web servers that used this piece of code. That function belonged to the fres
Talos
Vulnerability Spotlight: How a code re-use issue led to vulnerabilities across multiple products
blogs_talos·2022-07-27
Vulnerability Spotlight: How a code re-use issue led to vulnerabilities across multiple products
## Vulnerability Spotlight: How a code re-use issue led to vulnerabilities across multiple products
Recently, I was performing some research on a wireless router and noticed the following piece of code:
This unescape function will revert the URL encoded bytes to its original form. But something specifically caught my attention: There was no size check for the performed operations and the function assumes that after a ‘%’ there are always two bytes. So, what would happen if after ‘%’, only one character existed? The answer is that the s+3, in the strcpy, will access after the end of the string. So, it could lead to memory corruption. Then, I tried to exploit this bug on the router in question. But based on how the URL string was managed in that device, it was not possible. But it had the
2022-08-05
Published