PT-2022-16376 · Asus · Asus Rt-Ax56U

Hanpeng · Published 2022-04-07 · Updated 2022-04-14 · CVE-2022-23972

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ASUS RT-AX56U (affected versions not specified)

Description The issue is related to an SQL injection vulnerability in the SQL handling function due to insufficient user input validation. This allows an unauthenticated LAN attacker to inject arbitrary SQL code, enabling them to read, modify, and delete database content.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-23972

Affected Products

Asus Rt-Ax56U

References · 4

• https://osv.dev/vulnerability/CVE-2022-23972 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23972 · Security Note
• https://twcert.org.tw/tw/cp-132-5786-d2e86-1.html · Note
• https://t.me/cibsecurity/40303 · Telegram Post