Vulnerability · Published Nov 25, 2025 · Assigned by ASUS

CVE-2025-59369

Medium 5.9

In plain English

A medium-severity SQL injection in Router from ASUS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 4.0)5.9Medium

Exploit odds (30 days)0.5%top 58.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A SQL injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbitrary SQL queries, leading to unauthorized data access. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

Affected products (as reported)

Vendor	Product	Versions
ASUS	Router	3.0.0.4_3863.0.0.4_3883.0.0.6_102

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://www.asus.com/security-advisory/ vendor-advisory