CVE-2022-26674CWE-134

ASUS RT-AX88U - Format String

Critical · published April 22, 2022

CVSS v3.1
9.8
EPSS
3%
Percentile
86.2
In the wild
Unconfirmed
What it is

🚨 A sneaky Format String vulnerability in the ASUS RT-AX88U could let an attacker remotely execute code with NO authentication! 🔥 Think of it like a chef who accidentally leaves a recipe card unattended — while they pick up groceries, someone else could read it, modify the recipe, and ruin dinner completely! With this vulnerability, an attacker could write to arbitrary memory addresses, potentially allowing them to take control of your router, execute malicious commands, or even disrupt your internet service entirely. This isn’t just a minor inconvenience — it could lead to a complete takeover of your network. 😱

Put simply

Think of it like a chef who accidentally leaves a recipe card unattended — while they pick up groceries, someone else could read it, modify the recipe, and ruin dinner completely! This Format String vulnerability allows unauthorized remote attackers to manipulate memory addresses, enabling arbitrary code execution and system operations through crafted input. This flaw exists in the ASUS RT-AX88U router firmware versions prior to the patch.

What to do

With this vulnerability, an attacker could write to arbitrary memory addresses, potentially allowing them to take control of your router, execute malicious commands, or even disrupt your internet service entirely. This isn’t just a minor inconvenience — it could lead to a complete takeover of your network. 😱 To secure your device, update the firmware to the latest version immediately. Additionally, ensure you review your network configurations, and consider changing default passwords to enhance security. 🛡️ You've got this! By taking these simple steps, you can lock this vulnerability down and protect your network. 🚀

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02763 · 86.2th percentile
Weakness
CWE-134 · Use of Externally-Controlled Format String
Published
2022-04-22T06:50Z
EPSS history
Timeline
  • 22 APR 06:50Z
    ASUS RT-AX88U - Format String
    cvelistv5