What is CVE-2022-25596?

CVE-2022-25596 is a high-severity vulnerability in ASUS Rt-Ac86u, classified under Out-of-bounds Write. CVSS score: 8.8/10. Published 2022-04-07.

How severe is CVE-2022-25596?

High severity. CVSS v3 base score is 8.8 out of 10.

Buffer overflow in ASUS Rt-Ac86u

CVE-2022-25596

ASUS RT-AC56U’s configuration function has a heap-based buffer overflow vulnerability due to insufficient validation for the decryption parameter length, which allows an unauthenticated LAN attacker to execute arbitrary code, perform arbitrary operations and disrupt service.

Vulnerability class: Buffer Overflow

EPSS: 0.006 (46.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Asus Rt-ac86u — versions 3.0.0.4.386.45956
Asus Rt-ac86u_firmware — versions 3.0.0.4.386.45956

Weakness classification (CWE)

CWE-787 — Out-of-bounds Write

References

twcert@cert.org.tw (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2022-25596?: CVE-2022-25596 is a high-severity vulnerability in ASUS Rt-Ac86u, classified under Out-of-bounds Write. CVSS score: 8.8/10. Published 2022-04-07.
How severe is CVE-2022-25596?: High severity. CVSS v3 base score is 8.8 out of 10.