Vulnerability · Published Nov 25, 2025 · Assigned by ASUS

CVE-2025-59370

High 7.5

In plain English

A high-severity OS command injection in Router from ASUS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 4.0)7.5High

Exploit odds (30 days)1.0%top 38.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A command injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbitrary commands, leading to the device executing unintended instructions. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

Affected products (as reported)

Vendor	Product	Versions
ASUS	Router	3.0.0.4_3863.0.0.4_3883.0.0.6_102

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.asus.com/security-advisory/ vendor-advisory