CVE-2022-23972 - ASUS RT-AX56U - SQL Injection

Back Back to CVE browser

HIGH

ASUS RT-AX56U - SQL Injection

Published Apr 7, 2022

8.8

HIGH

CVSS 3.1

EPSS 0.54%

Description

ASUS RT-AX56U’s SQL handling function has an SQL injection vulnerability due to insufficient user input validation. An unauthenticated LAN attacker to inject arbitrary SQL code to read, modify and delete database.

Affected products

Vendor ASUS Product RT-Ax56u Default
n/a
- Version
  3.0.0.4.386.45898
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ASUS

RT-Ax56u

n/a

Version	Status	Constraints
3.0.0.4.386.45898	affected	-

Remediation

Vendor solution

Update ASUS RT-AX56U firmware version to 3.0.0.4.386.45934

Weaknesses (1)

CWE-89

SQL Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-28888
Advisory
https://www.twcert.org.tw/tw/cp-132-5786-d2e86-1.html
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-28888		Advisory
https://www.twcert.org.tw/tw/cp-132-5786-d2e86-1.html		x_refsource_MISCThird Party Advisory