Vulnerability · Published Mar 26, 2026 · Assigned by ASUS

CVE-2025-15101

High 8.6

In plain English

A high-severity OS command injection in Router from ASUS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.9%top 39.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrators to execute arbitrary system commands via a crafted parameter. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

Affected products (as reported)

Vendor	Product	Versions
ASUS	Router	3.0.0.6_102

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.asus.com/security-advisory/ vendor-advisory