ASUS

Products

Exploited and recent CVEs

• CVE-2025-59374 Critical 9.3 Exploited "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cau 1.2%
• CVE-2023-39780 High 8.8 Exploited On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar "token-generated module" i 39.5%
• CVE-2026-84729 High 7.2 Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intended buffer or potentially cause a denial-of-service (DoS) via a crafted packe 0.2%
• CVE-2026-84730 High 8.7 Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with root privileges via a crafted device name. Refer to the ' Secur 0.3%
• CVE-2026-112116 High 8.5 An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write arbitrary physical memory through crafted device control reques 0.1%
• CVE-2026-110464 Medium 6.9 Missing authorization in ASUS Armoury Crate allows a local attacker to write content into a specific file or registry location with Local System privileges, or to cause a recoverable system crash, via <0.1%
• CVE-2026-88781 Medium 6.8 Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory address via an I/O command, leading to subsequent system inform 0.1%
• CVE-2026-75775 High 7.7 Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the route 0.6%
• CVE-2026-93489 High 8.7 Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operati 0.2%
• CVE-2026-75779 High 8.6 Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administ 1.2%
• CVE-2026-75753 Medium 5.3 Missing Authentication for a Critical Function  in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to return device identificati 0.2%
• CVE-2026-17518 High 8.2 Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input 0.2%
• CVE-2026-102438 High 8.5 An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is late 0.2%
• CVE-2026-102438 High 8.5 An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is late 0.2%
• CVE-2026-14911 Critical 9.3 Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial 0.3%
• CVE-2026-19396 High 7.7 A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and r 0.1%
• CVE-2026-19386 Critical 9.3 A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Ref 0.2%
• CVE-2026-16528 High 8.4 Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, potentially enabling modification 0.2%
• CVE-2026-13313 High 8.9 An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby ex 0.7%
• CVE-2026-14157 Critical 9.4 Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interfac 0.8%
• CVE-2026-93495 High 7.0 Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device. Refer to the '  Security Update fo 0.2%
• CVE-2026-93495 High 7.0 Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device. Refer to the '  Security Update fo 0.2%
• CVE-2026-93495 High 7.0 Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device. Refer to the '  Security Update fo 0.2%
• CVE-2026-93495 High 7.0 Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device. Refer to the '  Security Update fo 0.2%
• CVE-2026-93495 High 7.0 Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device. Refer to the '  Security Update fo 0.2%
• CVE-2026-93495 High 7.0 Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device. Refer to the '  Security Update fo 0.2%
• CVE-2026-93495 High 7.0 Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device. Refer to the '  Security Update fo 0.2%
• CVE-2026-93495 High 7.0 Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device. Refer to the '  Security Update fo 0.2%
• CVE-2026-93495 High 7.0 Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device. Refer to the '  Security Update fo 0.2%
• CVE-2026-93495 High 7.0 Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device. Refer to the '  Security Update fo 0.2%