Buffer overflow in ASUS Rt-Ax56u
CVE-2021-40556
A stack overflow vulnerability exists in the httpd service in ASUS RT-AX56U Router Version 3.0.0.4.386.44266. This vulnerability is caused by the strcat function called by "caupload" input handle function allowing the user to enter 0xFFFF bytes into the stack. This vulnerability allows an attacker to execute commands remotely. The vulnerability requires authentication.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.016 (75.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 75th percentile — 75.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.014 · newest: 0.016 · change: +0.002
Affected products
- ASUS Rt-Ax56u
- ASUS Rt-Ax56u Firmware — versions 3.0.0.4.386.44266
Weakness classification (CWE)
References
- www.asus.com/tw/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/… (Product, Vendor Advisory)
- x1ng.top/2021/10/14/ASUS栈溢出漏洞分析/ (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-40556?
- CVE-2021-40556 is a high-severity vulnerability in ASUS Rt-Ax56u, classified under Out-of-bounds Write. CVSS score: 8.8/10. Published 2022-10-06.
- How severe is CVE-2021-40556?
- High severity. CVSS v3 base score is 8.8 out of 10.