CVE-2022-23973

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

ASUS RT-AX56U’s user profile configuration function is vulnerable to stack-based buffer overflow due to insufficient validation for parameter length. An unauthenticated LAN attacker can execute arbitrary code to perform arbitrary operations or disrupt service.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
ASUS	RT-AX56U	3.0.0.4.386.45898

References

https://www.twcert.org.tw/tw/cp-132-5787-b0e64-1.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-5787-b0e64-1.htmlThird Party Advisory

Timeline

Published: Apr 7, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-239747.5In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot instal CVE-2022-239756.5Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to activate any installed plugin.CVE-2022-239768.1Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset all data (posts / pages / media)CVE-2022-239794.8Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15).CVE-2022-23984.8The WordPress Comments Fields WordPress plugin before 4.1 does not escape Field Error Message, which could allow high-privileged users to pe CVE-2022-239806.1Cross-Site Scripting (XSS) vulnerability discovered in Yasr – Yet Another Stars Rating WordPress plugin (versions <= 2.9.9), vulnerable at p CVE-2022-239814.3The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4).CVE-2022-239827.5The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure.CVE-2022-239838.8Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click CVE-2022-239847.5Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11).CVE-2022-239857.8The affected product is vulnerable to an out-of-bounds write while processing project files, which allows an attacker to craft a project fil CVE-2022-239867.5SQL injection vulnerability in the phpUploader v1.2 and earlier allows a remote unauthenticated attacker to obtain the information in the da