ASUS Router vulnerabilities

CVE-2026-14911 Critical · 9.3 CWE-79 Oct 7, 2026

Cross-site Scripting (XSS) in ASUS Router

Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

CVE-2026-19396 High · 7.7 CWE-337 Oct 6, 2026

A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing…

A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and read or modify router settings via observed values from an administrator-initiated IFTTT pairing session.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

CVE-2026-19386 Critical · 9.3 CWE-121 Oct 6, 2026

Stack-based Buffer Overflow in ASUS Router

A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

CVE-2026-16528 High · 8.4 CWE-532 Oct 6, 2026

Insertion of Sensitive Information into Log File in ASUS Router

Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, potentially enabling modification of DNS settings.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

CVE-2026-13385 Critical · 9.5 CWE-295 Jul 14, 2026

Improper Certificate Validation in ASUS Router

An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middle(MITM) user to make the router download and execute arbitrary command via a spoofed server. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

CVE-2026-11851 Medium · 5.9 CWE-89 Jul 14, 2026

SQL Injection in ASUS Router

Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certain ASUS router models allows a remote authenticated user to disclose confidential information via a crafted request that bypasses existing input validation Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

CVE-2025-15101 High · 8.8 CWE-78 Mar 26, 2026

OS Command Injection in Asus Asus Firmware

An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrators to execute arbitrary system commands via a crafted parameter. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

CVE-2025-59372 Medium · 6.9 CWE-22 Nov 25, 2025

Path Traversal in ASUS Router

A path traversal vulnerability has been identified in certain router models. A remote, authenticated attacker could exploit this vulnerability to write files outside the intended directory, potentially affecting device integrity. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

CVE-2025-59371 High · 7.5 CWE-330 Nov 25, 2025

Use of Insufficiently Random Values in ASUS Router

An authentication bypass vulnerability has been identified in the IFTTT integration feature. A remote, authenticated attacker could leverage this vulnerability to potentially gain unauthorized access to the device. This vulnerability does not affect Wi-Fi 7 series models. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

CVE-2025-59370 High · 7.5 CWE-78 Nov 25, 2025

OS Command Injection in ASUS Router

A command injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbitrary commands, leading to the device executing unintended instructions. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

CVE-2025-59369 Medium · 5.9 CWE-89 Nov 25, 2025

SQL Injection in ASUS Router

A SQL injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbitrary SQL queries, leading to unauthorized data access. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

CVE-2025-59368 Medium · 6.0 CWE-191 Nov 25, 2025

Integer Underflow in ASUS Router

An integer underflow vulnerability has been identified in Aicloud. An authenticated attacker may trigger this vulnerability by sending a crafted request, potentially impacting the availability of the device. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

CVE-2025-59366 Critical · 9.2 CWE-22 Nov 25, 2025

Path Traversal in ASUS Router

An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba functionality, potentially leading to allow execution of specific functions without proper authorization. Refer to the Security Update for ASUS Router Firmware section on the ASUS Security Advisory for more information.

CVE-2025-59365 Medium · 6.9 CWE-121 Nov 25, 2025

Stack-based Buffer Overflow in ASUS Router

A stack buffer overflow vulnerability has been identified in certain router models. An authenticated attacker may trigger this vulnerability by sending a crafted request, potentially impacting the availability of the device. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

CVE-2025-12003 High · 8.2 CWE-22 Nov 25, 2025

Path Traversal in ASUS Router

A path traversal vulnerability has been identified in WebDAV, which may allow unauthenticated remote attackers to impact the integrity of the device. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.