CVE-2022-26376: ASUS Asuswrt

Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days.

A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.

Affected products

ASUS Asuswrt: before 3.0.0.4.386_48706 (fixed in 3.0.0.4.386_48706)
ASUS ET12 Firmware: before 3.0.0.4.386_48823 (fixed in 3.0.0.4.386_48823)
ASUS Gt-AX11000 Firmware: before 3.0.0.4.386_49559 (fixed in 3.0.0.4.386_49559)
ASUS Gt-AX11000 Pro Firmware: before 3.0.0.4.386_48996 (fixed in 3.0.0.4.386_48996)
ASUS Gt-AX6000 Firmware: before 3.0.0.4.386_48823 (fixed in 3.0.0.4.386_48823)
ASUS Gt-AXE16000 Firmware: before 3.0.0.4.386_48786 (fixed in 3.0.0.4.386_48786)
ASUS RT-AX55 Firmware: before 3.0.0.4.386_49559 (fixed in 3.0.0.4.386_49559)
ASUS Rt-AX56U Firmware: before 3.0.0.4.386_49559 (fixed in 3.0.0.4.386_49559)
ASUS Rt-AX58U Firmware: before 3.0.0.4.386_48908 (fixed in 3.0.0.4.386_48908)
ASUS Rt-AX68U Firmware: before 3.0.0.4.386_49479 (fixed in 3.0.0.4.386_49479)
ASUS Rt-AX82U Firmware: before 3.0.0.4.386_49380 (fixed in 3.0.0.4.386_49380)
ASUS Rt-AX86U Firmware: before 3.0.0.4.386_49447 (fixed in 3.0.0.4.386_49447)
ASUS Tuf-AX3000 v2 Firmware: before 3.0.0.4.386_48750 (fixed in 3.0.0.4.386_48750)
ASUS XD4 Firmware: before 3.0.0.4.386_48790 (fixed in 3.0.0.4.386_48790)
ASUS XD6 Firmware: before 3.0.0.4.386_49356 (fixed in 3.0.0.4.386_49356)
ASUS XT12 Firmware: before 3.0.0.4.386_48823 (fixed in 3.0.0.4.386_48823)
ASUS XT8 Firmware: before 3.0.0.4.386_48706 (fixed in 3.0.0.4.386_48706)
ASUS XT9 Firmware: before 3.0.0.4.388_20027 (fixed in 3.0.0.4.388_20027)
Asuswrt-Merlin New Gen: before 386.7 (fixed in 386.7)

Published 2022-08-05. Last modified 2026-06-17.