CVE-2022-35401 Auth bypass in RT-AX82U

Critical 9.0 Published 10 Jan 2023 Updated 5 Mar 2025

An attacker can bypass authentication to gain full administrative access to Asus RT-AX82U routers via crafted HTTP requests.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-35401?

CVE-2022-35401 is a critical authentication bypass vulnerability in Asus RT-AX82U, published on 10 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_49674-ge182230. A specially-crafted HTTP request can lead to full administrative access to the device. An attacker would need to send a series of HTTP requests to exploit this vulnerability.

Weakness: CWE-287, CWE-324

Which versions are affected by CVE-2022-35401?

It affects 1 product.

Products include Asus Rt-Ax82u Firmware.

How do I fix CVE-2022-35401?

No fix has been published for CVE-2022-35401 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-35401 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-35401 exists.

Sources

Also known as GHSA-rj78-2fm5-wrfp.