CVE-2022-26376: asus asuswrt Out-of-bounds Write
Vulnerability summary
CVE-2022-26376 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in asus asuswrt. EPSS estimates a 1.41% chance of exploitation in the next 30 days, higher than 72.2% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 05-08-2022PublishedVulnerability first disclosed.
- 15-04-2025Last modifiedVulnerability information updated.
Description
A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST5.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
1.41%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
+0.09 pp
From 1.32% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (talosintelligence.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Asus18 products
- asuswrt< 3.0.0.4.386_48706
- et12_firmware< 3.0.0.4.386_48823
- gt-ax11000_firmware< 3.0.0.4.386_49559
- gt-ax11000_pro_firmware< 3.0.0.4.386_48996
- gt-ax6000_firmware< 3.0.0.4.386_48823
Asuswrt-merlin2 products
- asuswrt-merlin new genprior to 386.7
- new_gen< 386.7
2 vendors · 20 products