CVE-2022-26674: ASUS RT-AX88U - Format String

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-22 · updated 2026-06-17
Weakness: CWE-134

Description

ASUS RT-AX88U has a Format String vulnerability, which allows an unauthenticated remote attacker to write to arbitrary memory address and perform remote arbitrary code execution, arbitrary system operation or disrupt service.

Affected products

ASUS RT-AX88U: before 3.0.0.4.386.46065 — fixed in 3.0.0.4.386.46065

How to fix

Upgrade to a fixed version: ASUS RT-AX88U 3.0.0.4.386.46065. Check the vendor advisory for mitigations.

References

https://www.twcert.org.tw/tw/cp-132-6043-0f72c-1.html
https://www.twcert.org.tw/tw/cp-132-6043-0f72c-1.html

Get alerted when CVE-2022-26674 or the next vulnerability affects your stack