CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2022-26376
Critical (9.8). EPSS 1.5% chance of exploitation in the next 30 days.
A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.
Severity
- EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
- CWE
- CWE-787
- Published
- Modified
- Record from
- the NVD, synced
Affected
- asus:asuswrt
- asus:et12_firmware
- asus:gt-ax11000_firmware
- asus:gt-ax11000_pro_firmware
- asus:gt-ax6000_firmware
- asus:gt-axe16000_firmware
- asus:rt-ax55_firmware
- asus:rt-ax56u_firmware
- asus:rt-ax58u_firmware
- asus:rt-ax68u_firmware
- asus:rt-ax82u_firmware
- asus:rt-ax86u_firmware
- asus:tuf-ax3000_v2_firmware
- asus:xd4_firmware
- asus:xd6_firmware
- asus:xt12_firmware
- asus:xt8_firmware
- asus:xt9_firmware
- asuswrt-merlin:new_gen