CVE-2022-35401

Executive Summary

CVE-2022-35401 is an unauthenticated authentication bypass vulnerability in the get_IFTTTTtoken.cgi endpoint of the Asus RT-AX82U router firmware version 3.0.0.4.386_49674-ge182230. The flaw allows a remote, unauthenticated attacker to gain full administrative access to the device by sending a series of crafted HTTP requests. With a CVSS score of 9.0 and an EPSS percentile of 97.3%, this vulnerability represents a critical risk to affected home networks, potentially enabling complete device compromise, network pivoting, and man-in-the-middle attacks. No patch is currently available, and no public exploit code or CISA KEV listing has been confirmed.

Technical Analysis

The vulnerability exists in the get_IFTTTTtoken.cgi functionality — an HTTP endpoint exposed on the Asus RT-AX82U administrative web interface. The NVD description indicates that a specially-crafted HTTP request can lead to full administrative access to the device, without any prior authentication.

The attack mechanism is a classic authentication bypass flaw (CWE-287). The endpoint fails to properly verify the session or authentication state of the requesting client. By sending a series of HTTP requests — likely a multi-step sequence that manipulates the router's internal state machine or session-handling logic — an attacker can cause the device to grant administrative privileges.

Several factors amplify the severity:

1. Exposure: The web management interface is commonly exposed to the local network and, in many misconfigured deployments, directly to the Internet via port 80/443 or via services like Asus DDNS.
2. No Authentication Required: The CVSS score of 9.0 implies minimal complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N).
3. Full Impact: The scope is changed (S:C) — exploitation compromises the device and the network behind it, affecting confidentiality, integrity, and availability.
4. Series of Requests: The multi-request nature suggests the attacker must interact with the device's HTTP state machine, potentially exploiting session fixation, a race condition, or inconsistent authorization checks between request handling stages.

Insufficient technical detail is available in the NVD description regarding the exact request structure or parameter manipulation. The affected firmware version (3.0.0.4.386_49674-ge182230) is one of many Asus RT-AX82U releases, meaning the flaw may exist across a broader range of versions but has not yet been confirmed by available sources.

Exploitation Scenarios

The following attack chain is inferred strictly from the NVD description (authentication bypass in get_IFTTTTtoken.cgi via a series of HTTP requests, resulting in full admin access). No public PoC is available; the chain is described at the vulnerability-class level.

Step 1 — Reconnaissance / Target Identification

• The attacker identifies Asus RT-AX82U devices exposed on the Internet. This can be done via Shodan/Censys using fingerprints of the router's web UI, banners containing "RT-AX82U", or default ports (80/443, 8080). Alternatively, an attacker on the local network scans for the device's IP.
• The attacker confirms the admin panel is reachable and that the device responds on the administrative HTTP/HTTPS interface.

Step 2 — Triggering the Flaw Class

• The attacker sends a series of HTTP requests to the get_IFTTTTtoken.cgi endpoint — a legitimate administrative function used to retrieve an IFTTT authentication token.
• Because the endpoint does not properly validate whether the requesting session is authenticated, the attacker can access it directly without supplying router admin credentials.

Step 3 — Payload / Execution Method (Vulnerability-Class Level)

• The attacker crafts HTTP requests that mimic the format expected by the endpoint, potentially including parameters that set or modify session state.
• The series of requests causes the router to issue an administrative token or to escalate the attacker's session privilege level to that of an admin. At the class level, this is a bypass of the authentication gate — the attacker is never required to provide the admin password.

Step 4 — Post-Exploitation Impact

• With full administrative access, the attacker can:
  • Change router DNS settings to redirect traffic to malicious servers (DNS hijacking for phishing/malware delivery).
  • Disable firewall rules or port forwarding to expose internal hosts.
  • Read and exfiltrate configuration files containing Wi-Fi credentials, ISP credentials, and VPN settings.
  • Install a persistent backdoor, either by modifying the firmware configuration or by leveraging the admin interface for later connection.
  • Perform man-in-the-middle attacks against all connected devices.
  • Use the router as a pivot for further lateral movement into the internal network.

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

Impact Assessment

The business impact of CVE-2022-35401 extends beyond the device itself, as the Asus RT-AX82U is a consumer-grade Wi-Fi 6 router commonly deployed in home offices, SMB environments, and remote-work setups.

Affected Systems: Asus RT-AX82U firmware 3.0.0.4.386_49674-ge182230. Other firmware builds may be affected, but insufficient data exists to confirm a broader range.

Detection Guidance

Sigma Rule

title: Asus RT-AX82U Authentication Bypass - get_IFTTTTtoken.cgi Requests
id: 2c0e0a1a-3f3a-4a2a-8a2a-1a2a3a4a5a6a
status: experimental
description: Detects HTTP requests targeting get_IFTTTTtoken.cgi without prior successful authentication
author: Valters IT Threat Intel
date: 2024/06/01
logsource:
  category: webserver
  product: asus_rt_ax82u
  definition: 'Requires access logs from Asus router admin interface or a reverse proxy'
detection:
  selection:
    cs-uri-query|contains:
      - 'get_IFTTTTtoken.cgi'
  filter_known_auth:
    cs-uri-query|contains:
      - 'session_id'
      - '&login='
  condition: selection and not filter_known_auth
level: high
falsepositives:
  - Legitimate IFTTT integration setup by the device owner
  - Automated management tools that use the endpoint

YARA Rule

rule Asus_RT_AX82U_Authentication_Bypass_IFTTTT
{
    meta:
        author = "Valters IT Threat Intel"
        description = "Detects HTTP traffic or logs containing references to get_IFTTTTtoken.cgi"
        cve = "CVE-2022-35401"
        date = "2024-06-01"
        severity = "critical"
    strings:
        $a = "get_IFTTTTtoken.cgi" ascii wide nocase
        $b = "IFTTTTtoken" ascii wide nocase
        $c = "RT-AX82U" ascii wide nocase
    condition:
        uint16(0) == 0x0A0D or uint32(0) == 0x0A0D0A0D or $a or $b
}

Note: This rule is designed for HTTP packet captures or web server log files. Adjust based on data source.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2022-35401 - Asus RT-AX82U get_IFTTTTtoken.cgi Auth Bypass Attempt"; flow:to_server,established; http.uri; content:"get_IFTTTTtoken.cgi"; http.method; content:"GET"; http.method; content:"POST"; http.method; content:"PUT"; reference:cve,2022-35401; classtype:attempted-admin; sid:10000001; rev:1;)

Note: The rule triggers on any HTTP method targeting the endpoint. In production, consider baselining legitimate usage and adding filters for source IP reputation.

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where destination.port == 80 or destination.port == 443]
  [http where url.path == "/get_IFTTTTtoken.cgi" and request.method in ("GET","POST","PUT")]
  [http where url.path != "/login.cgi" and url.path != "/login.cgi" and response.status_code != 200]

Note: The sequence assumes an attacker will interact with the endpoint repeatedly without proper authentication. Adjust baselines to normal device usage.

Splunk SPL Query

index=proxy OR index=firewall OR sourcetype=access_combined
| where uri_path="/get_IFTTTTtoken.cgi" OR uri LIKE "%get_IFTTTTtoken.cgi%"
| stats count by src_ip, uri, http_method, status
| where count > 3
| eval severity=case(status>=400, "high", status<400, "medium")
| table _time, src_ip, uri, http_method, status, count, severity

Note: This query looks for repeated access attempts to the vulnerable endpoint; frequency thresholds may be adjusted per environment.

Wazuh OSSEC Rule

<group name="asus_router,">
  <rule id="100202" level="12">
    <decoded_as>webaccess</decoded_as>
    <field name="url">\.cgi</field>
    <match>get_IFTTTTtoken\.cgi</match>
    <description>Asus RT-AX82U get_IFTTTTtoken.cgi accessed - possible CVE-2022-35401 auth bypass attempt</description>
    <group>authentication_failures,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor fix has been identified from any tracked source. The device remains vulnerable as of this report.

1. Immediate Mitigations

• Disable remote administration: Do not expose the router's web management interface to the Internet.
  • In the Asus web UI: Administration → System → Remote Access Settings → Set "Enable Web Access from WAN" to No.
• Restrict local network access: If firmware updates are delayed, limit which LAN IPs can access the admin panel.
• Use VPN for management: Allow router management only via a VPN tunnel rather than direct exposure.
• Disable IFTTT integration if not actively used, as the vulnerable endpoint (get_IFTTTTtoken.cgi) serves this feature.
• Monitor router logs for anomalous requests to .cgi endpoints, especially from unexpected source IPs.

2. Patch/Upgrade Steps

• Check for firmware updates at ASUS Support for the RT-AX82U.
• As of this report, no patched firmware version is publicly available — validate firmware release notes before upgrading; if a new build (≥ 3.0.0.4.386_xxxxx or 3.0.0.6.x) is released, test on a non-production router first.
• Subscribe to ASUS security advisories for the RT series to receive notification of a fix.

3. Long-Term Hardening

• Segment the network: Place IoT/network devices on a dedicated VLAN with egress filtering to internal resources.
• Centralize logging: Enable router syslog forwarding to a SIEM; configure alerts for .cgi endpoint access.
• Decommission unsupported devices if the vendor does not release a timely patch.
• Replace with alternative hardware if the ASUS device reaches end-of-life without a security fix.
• Implement network-layer detection for suspicious HTTP patterns targeting router management interfaces (via Suricata/Zeek at the network edge).

Until a patch is available, the most effective control is to eliminate remote exposure of the management interface entirely.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2022-35401 — Official National Vulnerability Database record; provides the confirmed CVE description and metadata.
2. ASUS Security Advisories: https://www.asus.com/support/security-advisories — Vendor site; monitor for future firmware releases addressing this CVE.
3. FIRST EPSS: https://www.first.org/epss/api (CVE-2022-35401 score: 0.20849 / 97.3rd percentile) — Prioritization data indicating high real-world exploitation probability.
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2022-35401 is not currently listed; check periodically for updates.
5. Shodan Search: https://www.shodan.io/search?query=http.title%3A%22RT-AX82U%22 — Reference for identifying internet-exposed RT-AX82U devices.

Threat Actor Campaigns: No specific public threat actor campaign has been attributed to this CVE at the time of writing. Given the EPSS percentile (97.3%) and the unpatched status, exploit-in-the-wild attempts are considered likely, though no public evidence confirms active weaponization.