What is CVE-2021-40556?

CVE-2021-40556 is a high-severity vulnerability in ASUS Rt-Ax56u, classified under Out-of-bounds Write. CVSS score: 8.8/10. Published 2022-10-06.

How severe is CVE-2021-40556?

High severity. CVSS v3 base score is 8.8 out of 10.

Buffer overflow in ASUS Rt-Ax56u

CVE-2021-40556

A stack overflow vulnerability exists in the httpd service in ASUS RT-AX56U Router Version 3.0.0.4.386.44266. This vulnerability is caused by the strcat function called by "caupload" input handle function allowing the user to enter 0xFFFF bytes into the stack. This vulnerability allows an attacker to execute commands remotely. The vulnerability requires authentication.

Vulnerability class: Buffer Overflow

EPSS: 0.014 (70.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Asus Rt-ax56u
Asus Rt-ax56u_firmware — versions 3.0.0.4.386.44266
N/a — versions n/a

Weakness classification (CWE)

CWE-787 — Out-of-bounds Write

References

cve@mitre.org (Product, Vendor Advisory)
cve@mitre.org (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2021-40556?: CVE-2021-40556 is a high-severity vulnerability in ASUS Rt-Ax56u, classified under Out-of-bounds Write. CVSS score: 8.8/10. Published 2022-10-06.
How severe is CVE-2021-40556?: High severity. CVSS v3 base score is 8.8 out of 10.