CVE-2022-22054
Assigner: twcert
Published: 2022-01-14T00:00:00
State: PUBLISHED
affected: product: RT-AX56U
vendor: ASUS
versions: status: affected
version: 3.0.0.4.386.44266
datePublic: 2022-01-14T00:00:00
descriptions: value: ASUS RT-AX56U’s login function contains a path traversal vulnerability due to its inadequate filtering for special characters in URL parameters, which allows an unauthenticated local area network attacker to access restricted system paths and download arbitrary files.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
type: CWE
source: advisory: TVN-202201002
discovery: EXTERNAL
title: ASUS RT-AX56U - Path Traversal
x_generator: engine: Vulnogram 0.0.9