ASUS RT-AX56U - Path Traversal

Vulnerability

CVE-2022-22054 is a path traversal vulnerability in the login function of the ASUS RT-AX56U router. The URL parameters of the login page do not adequately filter special characters, allowing an attacker to traverse directories. The affected firmware version is 3.0.0.4.386.44266 (as per the advisory). [1]

Exploitation

An unauthenticated attacker with access to the local area network can send crafted HTTP requests to the login endpoint. By injecting path traversal sequences (such as ../) in URL parameters, the attacker can navigate to restricted system paths. No authentication is needed, and no user interaction is required. [1]

Impact

Successful exploitation allows the attacker to download arbitrary files from the router's filesystem. This is a confidentiality impact, as the attacker can read sensitive files such as configuration files or credentials. The CVSS score is 6.5 (Medium) with the vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. [1]

Mitigation

ASUS was contacted for a firmware update; the advisory states to contact ASUS for version updates. No fixed version is explicitly listed in the reference. The user should apply the latest firmware available from ASUS. If no patch is available, network segmentation and restricting LAN access may reduce risk. [1]