ASUS Vulnerabilities and Affected Products

Open in search

Vulnerabilities associated with RT-AX88U.

Products

Clear product

Showing 9 vulnerabilities on this page for RT-AX88U

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

ASUS Router - Improper Authentication

Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in the device.

CWE-287Jun 14, 20241 related artifact
CVSS9.8v3.1EPSS43.5%PoCs0SignalsSTIX

ASUS Router - Stack-based Buffer Overflow

Certain models of ASUS routers have buffer overflow vulnerabilities, allowing remote attackers with administrative privileges to execute arbitrary commands on the device.

CWE-121Jun 14, 2024
CVSS7.2v3.1EPSS0.826%PoCs0SignalsSTIX

ASUS OVPN RCE

ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS ExpertWiFi, ASUS RT-AX55, ASUS RT-AX58U, ASUS RT-AC67U, ASUS RT-AC68R, ASUS RT-AC68U, ASUS RT-AX86, ASUS RT-AC86U, ASUS RT-AX88U, and ASUS RT-AX3000.

CWE-78May 20, 2024
CVSS7.2v3.1EPSS0.735%PoCs0SignalsSTIX

ASUS RT-AX88U - externally-controlled format string

ASUS router RT-AX88U has a vulnerability of using externally controllable format strings within its Advanced Open VPN function. An authenticated remote attacker can exploit the exported OpenVPN configuration to execute an externally-controlled format string attack, resulting in sensitivity information leakage, or forcing the device to reset and permanent denial of service.

CWE-134Sep 18, 2023
CVSS8.8v3.1EPSS0.645%PoCs0SignalsSTIX

ASUS RT-AX88U - Stored XSS

A stored cross-site scripting (XSS) issue was discovered within the Custom User Icons functionality of ASUS RT-AX88U running firmware versions 3.0.0.4.388.23110 and prior.  After a remote attacker logging in device with regular user privilege, the remote attacker can perform a Stored Cross-site Scripting (XSS) attack by uploading image which containing JavaScript code.

CWE-79Jul 31, 2023
CVSS8.2v3.1EPSS0.465%PoCs0SignalsSTIX

ASUS RT-AX88U - Out-of-bounds Read - 2

ASUS RT-AX88U's httpd is subject to an unauthenticated DoS condition. A remote attacker can send a specially crafted request to the device which causes the httpd binary to crash within the "do_json_decode()" function of ej.c, resulting in a DoS condition.

CWE-125Jul 31, 2023
CVSS7.5v3.1EPSS0.815%PoCs0SignalsSTIX

ASUS RT-AX88U - Out-of-bounds Read - 1

ASUS RT-AX88U's httpd is subject to an unauthenticated DoS condition. A remote attacker can send a specially crafted request to a device which contains a specific user agent, causing the httpd binary to crash during a string comparison performed within web.c, resulting in a DoS condition.

CWE-125Jul 31, 2023
CVSS7.5v3.1EPSS0.815%PoCs0SignalsSTIX

ASUS RT-AX88U - Format String

ASUS RT-AX88U has a Format String vulnerability, which allows an unauthenticated remote attacker to write to arbitrary memory address and perform remote arbitrary code execution, arbitrary system operation or disrupt service.

CWE-134Apr 22, 2022
CVSS9.8v3.1EPSS2.6%PoCs0SignalsSTIX

ASUS RT-AX88U - Stored XSS

ASUS RT-AX88U has insufficient filtering for special characters in the HTTP header parameter. A remote attacker with general user privilege can exploit this vulnerability to inject JavaScript and perform Stored Cross-Site Scripting (XSS) attacks.

CWE-79Apr 22, 2022
CVSS5.4v3.1EPSS0.57%PoCs0SignalsSTIX