Vulnerabilidades de Asus
CVEs publicadas que afetam produtos de Asus: 65 registro(s), com severidade, exploração e correções.
Armoury Crate 17Router 17ASUS Business Manager 5ASUS System Control Interface 5AI Suite 3 3System Control Interface v3 3ASUS Business System Control Interface 2Myasus 2FA507NV 1Motherboard(PRIME Z390-A/H10 ) 1Motherboard(PRIME Z390-A ) 1Control Center Express Agent 1Control Center Enterprise (ACC) 1FA507NU 1DSL-N16 1AURA SYNC 1Aura Wallpaper Service 1GameSDK 1Router app 1DSL-AC750 1Z590 series 1Motherboard(ROG MAXIMUS XI HERO ) 1Motherboard(ROG MAXIMUS XI HERO (WI-FI) ) 1Motherboard(ROG MAXIMUS XI FORMULA ) 1Motherboard(ROG MAXIMUS XI CODE ) 1Motherboard(ROG MAXIMUS XI EXTREME ) 1Motherboard(ROG MAXIMUS XI APEX ) 1Motherboard(ROG MAXIMUS XI GENE ) 1Motherboard(ROG STRIX Z390-E GAMING ) 1Motherboard(ROG STRIX Z390-F GAMING ) 1Motherboard(Pro WS C246-ACE ) 1Motherboard(WS Z390 PRO ) 1GPU Tweak III 1GPUTweakII 1VGAdll 1ASCI 1Lyra Mini Firmware 1Gt-ac2900 Firmware 1RT-AX55 1Rt-ax55 Firmware 1
CVE-2025-59372
Média · 6.9
CWE-22 25/11/2025
Path Traversal em ASUS Router
A path traversal vulnerability has been identified in certain router models. A remote, authenticated attacker could exploit this vulnerability to write files outside the intended directory, potentially affecting device integrity.
Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
CVE-2025-59371
Alta · 7.5
CWE-330 25/11/2025
Use of Insufficiently Random Values em ASUS Router
An authentication bypass vulnerability has been identified in the IFTTT integration feature. A remote, authenticated attacker could leverage this vulnerability to potentially gain unauthorized access to the device. This vulnerability does not affect Wi-Fi 7 series models.
Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
CVE-2025-59370
Alta · 7.5
CWE-78 25/11/2025
OS Command Injection em ASUS Router
A command injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbitrary commands, leading to the device executing unintended instructions.
Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
CVE-2025-59369
Média · 5.9
CWE-89 25/11/2025
SQL Injection em ASUS Router
A SQL injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbitrary SQL queries, leading to unauthorized data access.
Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
CVE-2025-59368
Média · 6.0
CWE-191 25/11/2025
Integer Underflow em ASUS Router
An integer underflow vulnerability has been identified in Aicloud. An authenticated attacker may trigger this vulnerability by sending a crafted request, potentially impacting the availability of the device.
Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
CVE-2025-59366
Crítica · 9.2
CWE-22 25/11/2025
Path Traversal em ASUS Router
An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba functionality, potentially leading to allow execution of specific functions without proper authorization.
Refer to the Security Update for ASUS Router Firmware section on the ASUS Security Advisory for more information.
CVE-2025-59365
Média · 6.9
CWE-121 25/11/2025
Stack-based Buffer Overflow em ASUS Router
A stack buffer overflow vulnerability has been identified in certain router models. An authenticated attacker may trigger this vulnerability by sending a crafted request, potentially impacting the availability of the device.
Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
CVE-2025-12003
Alta · 8.2
CWE-22 25/11/2025
Path Traversal em ASUS Router
A path traversal vulnerability has been identified in WebDAV, which may allow unauthenticated remote attackers to impact the integrity of the device.
Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
CVE-2025-59373
Alta · 8.5
CWE-732 24/11/2025
Incorrect Permission Assignment for Critical Resource em Asus Myasus
A local privilege escalation vulnerability exists in
the restore mechanism of
ASUS System Control Interface. It can be triggered when an unprivileged actor copies files without proper validation into protected system paths, potentially leading to arbitrary files being executed as SYSTEM.
For more information, please refer to section Security Update for MyASUS in the ASUS Security Advisory.
CVE-2025-59367
Crítica · 9.8
CWE-306 13/11/2025
Missing Authentication for Critical Function em Asus Dsl-ac51 Firmware
An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized access into the affected system. Refer to the 'Security Update for DSL Series Router' section on the ASUS Security Advisory for more information.
CVE-2025-9338
Alta · 7.3
CWE-119 06/11/2025
Buffer Errors (Improper Restriction of Operations within Memory Bounds) em ASUS Armoury Crate
A improper restriction of operations within the bounds of a memory buffer exists in AsIO3.sys driver. This vulnerability can be triggered by manually executing a specially crafted process, potentially leading to local privilage escalation.
For additional information, please refer to the 'Security Update for Armoury Crate App' section of the ASUS Security Advisory.
CVE-2025-9337
Média · 6.8
CWE-476 13/10/2025
NULL Pointer Dereference em ASUS Armoury Crate
A null pointer dereference has been identified in the AsIO3.sys driver. The vulnerability can be triggered by a specially crafted input, which may lead to a system crash (BSOD).
Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.
CVE-2025-9336
Média · 6.8
CWE-121 13/10/2025
Stack-based Buffer Overflow em ASUS Armoury Crate
A stack buffer overflow has been identified in the AsIO3.sys driver. This vulnerability can be triggered by input manipulation, may leading to a system crash (BSOD) or other potentially undefined execution.
Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.
CVE-2023-39780
Alta · 8.8
KEV Alta · 56 CWE-78 11/09/2023
ASUS RT-AX55 Routers OS Command Injection Vulnerability
On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar "token-generated module" issue, see CVE-2023-41345; for the similar "token-refresh module" issue, see CVE-2023-41346; for the similar "check token module" issue, see CVE-2023-41347; and for the similar "code-authentication module" issue, see CVE-2023-41348.
CVE-2021-32030
Crítica · 9.8
KEV Alta · 67 Exploit público CWE-287 06/05/2021
ASUS Routers Improper Authentication Vulnerability
The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.