CVE-2022-25597
ASUS RT-AC86U - Command Injection
- State
- Published
- Severity
- 8.8 High
- Published
- Apr 7, 2022
- Updated
- Sep 16, 2024
- Reserved
- Feb 21, 2022
Description
ASUS RT-AC86U’s LPD service has insufficient filtering for special characters in the user request, which allows an unauthenticated LAN attacker to perform command injection attack, execute arbitrary commands and disrupt or terminate service.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | twcert |
Weaknesses
- CWE-78 OS Command Injection
Affected Products
| Product | Versions |
|---|---|
RT-AC86UASUS |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.