title: ASUS RT-AX56U - Path Traversal
description: ASUS RT-AX56U’s login function contains a path traversal vulnerability due to its inadequate filtering for special characters in URL parameters, which allows an unauthenticated local area network attacker to access restricted system paths and download arbitrary files.
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
product: RT-AX56U
vendor: ASUS
versions:
status: affected, version: 3.0.0.4.386.44266
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]