Vulnerability Spotlight: Asus router access, information disclosure, denial of service vulnerabilities discovered
Summary: Cisco Talos discovered three vulnerabilities in Asus router software affecting the Wi-Fi 6-enabled RT-AX82U: TALOS-2022-1586 (CVE-2022-35401), an authentication bypass that can lead to full administrative privileges via a series of HTTP requests; TALOS-2022-1590 (CVE-2022-38105), an information disclosure in the opcode of the router's configuration service; and TALOS-2022-1592 (CVE-2022-38393), a denial of service in the same configuration service triggered by a specially crafted network packet. Talos worked with Asus on a fix, and users are encouraged to update to version 3.0.0.4.386_49674-ge182230, the version Talos tested and confirmed could be exploited.
Why it matters: An authentication bypass that hands over full administrative privileges on a router configurable for remote administration puts the device at the edge of the network in reach of an attacker sending HTTP requests, and Talos confirmed the listed firmware version could be exploited.
Read the original at Cisco Talos ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-2022-35401CVE-2022-38105CVE-2022-38393
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026