CVE-2022-26376

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-08-05 · updated 2026-06-17
Weakness: CWE-787

Description

A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.

Affected products

Asuswrt: before 3.0.0.4.386_48706 — fixed in 3.0.0.4.386_48706
ASUS Et12 Firmware: before 3.0.0.4.386_48823 — fixed in 3.0.0.4.386_48823
ASUS Gt-Ax11000 Firmware: before 3.0.0.4.386_49559 — fixed in 3.0.0.4.386_49559
ASUS Gt-Ax11000 Pro Firmware: before 3.0.0.4.386_48996 — fixed in 3.0.0.4.386_48996
ASUS Gt-Ax6000 Firmware: before 3.0.0.4.386_48823 — fixed in 3.0.0.4.386_48823
ASUS Gt-Axe16000 Firmware: before 3.0.0.4.386_48786 — fixed in 3.0.0.4.386_48786
ASUS RT-AX55: before 3.0.0.4.386_49559 — fixed in 3.0.0.4.386_49559
ASUS RT-AX56U: before 3.0.0.4.386_49559 — fixed in 3.0.0.4.386_49559
ASUS Rt-Ax58U Firmware: before 3.0.0.4.386_48908 — fixed in 3.0.0.4.386_48908
ASUS Rt-Ax68U Firmware: before 3.0.0.4.386_49479 — fixed in 3.0.0.4.386_49479
Asus RT-AX82U: before 3.0.0.4.386_49380 — fixed in 3.0.0.4.386_49380
ASUS Rt-Ax86U Firmware: before 3.0.0.4.386_49447 — fixed in 3.0.0.4.386_49447
ASUS Tuf-Ax3000 V2 Firmware: before 3.0.0.4.386_48750 — fixed in 3.0.0.4.386_48750
ASUS Xd4 Firmware: before 3.0.0.4.386_48790 — fixed in 3.0.0.4.386_48790
ASUS Xd6 Firmware: before 3.0.0.4.386_49356 — fixed in 3.0.0.4.386_49356
ASUS Xt12 Firmware: before 3.0.0.4.386_48823 — fixed in 3.0.0.4.386_48823
ASUS Xt8 Firmware: before 3.0.0.4.386_48706 — fixed in 3.0.0.4.386_48706
ASUS Xt9 Firmware: before 3.0.0.4.388_20027 — fixed in 3.0.0.4.388_20027
Asuswrt-Merlin New Gen: before 386.7 — fixed in 386.7

How to fix

Upgrade to a fixed version: Asuswrt 3.0.0.4.386_48706; ASUS Et12 Firmware 3.0.0.4.386_48823; ASUS Gt-Ax11000 Firmware 3.0.0.4.386_49559; ASUS Gt-Ax11000 Pro Firmware 3.0.0.4.386_48996; ASUS Gt-Ax6000 Firmware 3.0.0.4.386_48823; ASUS Gt-Axe16000 Firmware 3.0.0.4.386_48786; ASUS RT-AX55 3.0.0.4.386_49559; ASUS RT-AX56U 3.0.0.4.386_49559; ASUS Rt-Ax58U Firmware 3.0.0.4.386_48908; ASUS Rt-Ax68U Firmware 3.0.0.4.386_49479; Asus RT-AX82U 3.0.0.4.386_49380; ASUS Rt-Ax86U Firmware 3.0.0.4.386_49447. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-26376 or the next vulnerability affects your stack