CVE-2022-25597CWE-78

ASUS RT-AC86U - Command Injection

High · published April 7, 2022

CVSS v3.1
8.8
EPSS
1%
Percentile
55.6
In the wild
Unconfirmed
What it is

ASUS RT-AC86U’s LPD service has insufficient filtering for special characters in the user request, which allows an unauthenticated LAN attacker to perform command injection attack, execute arbitrary commands and disrupt or terminate service.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00784 · 55.6th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2022-04-07T18:22Z
EPSS history
Timeline
  • 07 APR 18:22Z
    ASUS RT-AC86U - Command Injection
    cvelistv5