CVE-2022-35401: asus rt-ax82u_firmware Use of a Key Past its Expiration Date
Vulnerability summary
CVE-2022-35401 is a critical (CVSS 9.0) Use of a Key Past its Expiration Date vulnerability in asus rt-ax82u_firmware. EPSS estimates a 20.85% chance of exploitation in the next 30 days, higher than 97.5% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 10-01-2023PublishedVulnerability first disclosed.
- 05-03-2025Last modifiedVulnerability information updated.
Description
An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_49674-ge182230. A specially-crafted HTTP request can lead to full administrative access to the device. An attacker would need to send a series of HTTP requests to exploit this vulnerability.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST9.0CriticalCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
20.85%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 20.85% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (talosintelligence.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-324Use of a Key Past its Expiration DateThe product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected systems
Asus1 product
- rt-ax82u_firmware3.0.0.4.386_49674-ge182230
1 vendor · 1 product