Details of VAR-202301-0789

ID

VAR-202301-0789

CVE

CVE-2022-38393

TITLE

Asus RT-AX82U Out-of-Bounds Read Vulnerability in Routers

Trust: 0.8

sources: JVNDB: JVNDB-2022-004974

DESCRIPTION

A denial of service vulnerability exists in the cfg_server cm_processConnDiagPktList opcode of Asus RT-AX82U 3.0.0.4.386_49674-ge182230 router's configuration service. A specially-crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability. Asus RT-AX82U Routers contain an out-of-bounds read vulnerability.Service operation interruption (DoS) It may be in a state. ASUS RT-AX82U is a wireless router made by the Chinese company ASUS. An attacker can use this vulnerability to cause problems through specially crafted network packets

Trust: 2.16

sources: NVD: CVE-2022-38393 // JVNDB: JVNDB-2022-004974 // CNVD: CNVD-2023-72258

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2023-72258

AFFECTED PRODUCTS

vendor:	asus	model:	rt-ax82u	scope:	eq	version:	3.0.0.4.386_49674-ge182230	Trust: 1.0
vendor:	asustek computer	model:	rt-ax82u	scope:	eq	version:	rt-ax82u firmware 3.0.0.4.386_49674-ge182230	Trust: 0.8
vendor:	asustek computer	model:	rt-ax82u	scope:	eq	version:	-	Trust: 0.8
vendor:	asus	model:	rt-ax82u 3.0.0.4.386 49674-ge182230	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2023-72258 // JVNDB: JVNDB-2022-004974 // NVD: CVE-2022-38393

CVSS

SEVERITY

CVSSV2

CVSSV3

talos-cna@cisco.com:	CVE-2022-38393
value:	HIGH
Trust: 1.0
nvd@nist.gov:	CVE-2022-38393
value:	HIGH
Trust: 1.0
NVD:	CVE-2022-38393
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2023-72258
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202301-795
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2023-72258
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

talos-cna@cisco.com:	CVE-2022-38393
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.0
Trust: 1.8
nvd@nist.gov:	CVE-2022-38393
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0

sources: CNVD: CNVD-2023-72258 // JVNDB: JVNDB-2022-004974 // CNNVD: CNNVD-202301-795 // NVD: CVE-2022-38393 // NVD: CVE-2022-38393

PROBLEMTYPE DATA

problemtype:	CWE-125	Trust: 1.0
problemtype:	Out-of-bounds read (CWE-125) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2022-004974 // NVD: CVE-2022-38393

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202301-795

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202301-795

PATCH

title:	top page	url:	https://www.asus.com/jp/	Trust: 0.8
title:	Patch for ASUS RT-AX82U Denial of Service Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/462566	Trust: 0.6
title:	ASUS RT-AX82U Buffer error vulnerability fix	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=220794	Trust: 0.6

sources: CNVD: CNVD-2023-72258 // JVNDB: JVNDB-2022-004974 // CNNVD: CNNVD-202301-795

EXTERNAL IDS

db:	NVD	id:	CVE-2022-38393	Trust: 3.8
db:	TALOS	id:	TALOS-2022-1592	Trust: 3.0
db:	JVNDB	id:	JVNDB-2022-004974	Trust: 0.8
db:	CNVD	id:	CNVD-2023-72258	Trust: 0.6
db:	CNNVD	id:	CNNVD-202301-795	Trust: 0.6

sources: CNVD: CNVD-2023-72258 // JVNDB: JVNDB-2022-004974 // CNNVD: CNNVD-202301-795 // NVD: CVE-2022-38393

REFERENCES

url:	https://talosintelligence.com/vulnerability_reports/talos-2022-1592	Trust: 3.6
url:	https://nvd.nist.gov/vuln/detail/cve-2022-38393	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2022-38393/	Trust: 0.6

sources: CNVD: CNVD-2023-72258 // JVNDB: JVNDB-2022-004974 // CNNVD: CNNVD-202301-795 // NVD: CVE-2022-38393

CREDITS

Discovered by Lilith >_> of Cisco Talos.

Trust: 0.6

sources: CNNVD: CNNVD-202301-795

SOURCES

db:	CNVD	id:	CNVD-2023-72258
db:	JVNDB	id:	JVNDB-2022-004974
db:	CNNVD	id:	CNNVD-202301-795
db:	NVD	id:	CVE-2022-38393

LAST UPDATE DATE

2024-08-14T15:26:54.792000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2023-72258	date:	2023-09-26T00:00:00
db:	JVNDB	id:	JVNDB-2022-004974	date:	2023-05-12T07:04:00
db:	CNNVD	id:	CNNVD-202301-795	date:	2023-01-16T00:00:00
db:	NVD	id:	CVE-2022-38393	date:	2023-01-14T04:31:45.110

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2023-72258	date:	2023-09-18T00:00:00
db:	JVNDB	id:	JVNDB-2022-004974	date:	2023-05-12T00:00:00
db:	CNNVD	id:	CNNVD-202301-795	date:	2023-01-10T00:00:00
db:	NVD	id:	CVE-2022-38393	date:	2023-01-10T21:15:11.963