CVE-2022-25595 ASUS RT-AC86U - Improper Input Validation
An unauthenticated LAN attacker can cause a denial of service on ASUS RT-AC86U routers by sending specific requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-25595?
CVE-2022-25595 is a medium-severity denial of service vulnerability in ASUS RT-AC86U, published on 7 Apr 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
ASUS RT-AC86U has improper user request handling, which allows an unauthenticated LAN attacker to cause a denial of service by sending particular request a server-to-client reply attempt.
Weakness: CWE-20
Which versions are affected by CVE-2022-25595?
It affects 1 product.
Products include Asus Rt-Ac86u Firmware.
How do I fix CVE-2022-25595?
No fix has been published for CVE-2022-25595 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-25595 being exploited?
There is no known exploitation of CVE-2022-25595 in the wild and no public exploit code.
Other vulnerabilities in ASUS RT-AC86U
- CVE-2023-35087 ASUS RT-AX56U V2 & RT-AC86U - Format String - 2
- CVE-2023-38031 ASUS RT-AC86U - Command injection vulnerability - 1
- CVE-2023-38032 ASUS RT-AC86U - Command injection vulnerability - 2
- CVE-2023-38033 ASUS RT-AC86U - Command injection vulnerability - 3
- CVE-2023-39236 ASUS RT-AC86U - Command injection vulnerability - 4
Sources
Also known as GHSA-wmmv-6988-fqcv.