title: ASUS RT-AC86U - Heap-based buffer overflow
description: ASUS RT-AC56U’s configuration function has a heap-based buffer overflow vulnerability due to insufficient validation for the decryption parameter length, which allows an unauthenticated LAN attacker to execute arbitrary code, perform arbitrary operations and disrupt service.
problem types: CWE-787 Out-of-bounds Write
affected:
{
product: RT-AC86U
vendor: ASUS
versions:
status: affected, version: 3.0.0.4.386.45956
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Update ASUS RT-AC86U firmware version to 3.0.0.4_386_46092