What’s Vulnerable › Vulnerabilities

CVE-2022-25597: ASUS RT-AC86U - Command Injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-04-07 · updated 2026-06-17
• Weakness: CWE-78

Description

ASUS RT-AC86U’s LPD service has insufficient filtering for special characters in the user request, which allows an unauthenticated LAN attacker to perform command injection attack, execute arbitrary commands and disrupt or terminate service.

Affected products

• ASUS RT-AC86U: 3.0.0.4.386.45956

References

• https://www.twcert.org.tw/tw/cp-132-5794-09c33-1.html
• https://www.twcert.org.tw/tw/cp-132-5794-09c33-1.html

Get alerted when CVE-2022-25597 or the next vulnerability affects your stack