Vulnerability · Published Apr 18, 2025 · Assigned by ASUS

CVE-2025-2492

Critical 9.2

In plain English

A critical-severity authentication bypass in Router from ASUS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)9.2Critical

Exploit odds (30 days)1.1%top 33.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

An improper authentication control vulnerability exists in AiCloud. This vulnerability can be triggered by a crafted request, potentially leading to unauthorized execution of functions. Refer to the 'ASUS Router AiCloud vulnerability' section on the ASUS Security Advisory for more information.

Affected products (as reported)

Vendor	Product	Versions
ASUS	Router	3.0.0.4_382 series3.0.0.4_386 series3.0.0.4_388 series3.0.0.6_102 series

Weakness: CWE-288 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

References

https://www.asus.com/content/asus-product-security-advisory/ vendor-advisory