CVE Feed

    Dashboard / CVE / CVE-2023-35720

    CVE-2023-35720

    ASUS RT-AX92U lighttpd mod_webdav.so SQL Injection Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected ASUS RT-AX92U routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mod_webdav.so module. When parsing a request, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-16078.

    Published:May 3, 2024
    Last Modified:Aug 12, 2025
    EPS:May 3, 2024
    EPSS Score:0.00115
    CVSS Score:6.5

    Affected Products

    Vendor
    Asus
    Product
    Rt-ax92u
    Vendor
    Asus
    Product
    Rt-ax92u Firmware

    Exploits

    No exploit reference

    Related CVEs

    CVE-2021-43702 (CVSS 9) — ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does n…
    CVE-2021-41435 (CVSS 9.8) — A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-A…
    CVE-2021-41436 (CVSS 7.5) — An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-…
    CVE-2018-20333 (CVSS 7.5) — An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can request /update_applist.asp …
    CVE-2018-20335 (CVSS 7.5) — An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can trigger a DoS of the httpd s…
    CVE-2018-20334 (CVSS 9.8) — An issue was discovered in ASUSWRT 3.0.0.4.384.20308. When processing the /start_apply.htm POST data, there is…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High