CVE-2021-40556

A stack overflow vulnerability exists in the httpd service in ASUS RT-AX56U Router Version 3.0.0.4.386.44266. This vulnerability is caused by the strcat function called by "caupload" input handle function allowing the user to enter 0xFFFF bytes into the stack. This vulnerability allows an attacker to execute commands remotely. The vulnerability requires authentication.

• CWE-787

• https://www.asus.com/tw/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/Product, Vendor Advisory
• https://x1ng.top/2021/10/14/ASUS%E6%A0%88%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/Exploit, Third Party Advisory
• https://www.asus.com/tw/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/Product, Vendor Advisory
• https://x1ng.top/2021/10/14/ASUS%E6%A0%88%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/Exploit, Third Party Advisory

Published

Oct 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40542Opensis-Classic Version 8.0 is affected by cross-site script…6.1
• CVE-2021-40543Opensis-Classic Version 8.0 is affected by a SQL injection v…9.8
• CVE-2021-40546Tenda AC6 US_AC6V4.0RTL_V02.03.01.26_cn.bin allows attackers…4.9
• CVE-2021-4055Heap buffer overflow in extensions in Google Chrome prior to…8.8
• CVE-2021-40553piwigo 11.5.0 is affected by a remote code execution (RCE) v…8.8
• CVE-2021-40555Cross site scripting (XSS) vulnerability in flatCore-CMS 2.2…5.4
• CVE-2021-40559A null pointer deference vulnerability exists in gpac throug…5.5
• CVE-2021-4056Type confusion in loader in Google Chrome prior to 96.0.4664…8.8
• CVE-2021-40562A Segmentation fault caused by a floating point exception ex…5.5
• CVE-2021-40563A Segmentation fault exists casued by null pointer dereferen…5.5
• CVE-2021-40564A Segmentation fault caused by null pointer dereference vuln…5.5
• CVE-2021-40565A Segmentation fault caused by a null pointer dereference vu…5.5