ASUS Router

• CVE-2026-75775 High 7.7 Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the route 0.6%
• CVE-2026-93489 High 8.7 Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operati 0.2%
• CVE-2026-75779 High 8.6 Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administ 1.2%
• CVE-2026-75753 Medium 5.3 Missing Authentication for a Critical Function  in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to return device identificati 0.2%
• CVE-2026-17518 High 8.2 Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input 0.2%
• CVE-2026-14911 Critical 9.3 Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial 0.3%
• CVE-2026-19396 High 7.7 A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and r 0.1%
• CVE-2026-19386 Critical 9.3 A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Ref 0.2%
• CVE-2026-16528 High 8.4 Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, potentially enabling modification 0.2%
• CVE-2026-13313 High 8.9 An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby ex 0.7%
• CVE-2026-14157 Critical 9.4 Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interfac 0.8%
• CVE-2026-13385 Critical 9.5 An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middle(MITM) user to make the router download and execute a 0.1%
• CVE-2026-11851 Medium 5.9 Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certain ASUS router models allows a remote authenticated user to disclose confid 0.5%
• CVE-2025-15101 High 8.6 An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrators to execute arbitrary system commands via a crafted parame 0.9%
• CVE-2025-59372 Medium 6.9 A path traversal vulnerability has been identified in certain router models. A remote, authenticated attacker could exploit this vulnerability to write files outside the intended directory, potentiall 0.6%
• CVE-2025-59371 High 7.5 An authentication bypass vulnerability has been identified in the IFTTT integration feature. A remote, authenticated attacker could leverage this vulnerability to potentially gain unauthorized access 0.6%
• CVE-2025-59370 High 7.5 A command injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbitrary commands, leading to the device exec 1.0%
• CVE-2025-59369 Medium 5.9 A SQL injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbitrary SQL queries, leading to unauthorized dat 0.5%
• CVE-2025-59368 Medium 6.0 An integer underflow vulnerability has been identified in Aicloud. An authenticated attacker may trigger this vulnerability by sending a crafted request, potentially impacting the availability of the 0.4%
• CVE-2025-12003 High 8.2 A path traversal vulnerability has been identified in WebDAV, which may allow unauthenticated remote attackers to impact the integrity of the device. Refer to the ' Security Update for ASUS Router Fir 0.7%
• CVE-2025-59365 Medium 6.9 A stack buffer overflow vulnerability has been identified in certain router models. An authenticated attacker may trigger this vulnerability by sending a crafted request, potentially impacting the ava 0.4%
• CVE-2025-59366 Critical 9.2 An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba functionality, potentially leading to allow execution of specifi 12.5%
• CVE-2025-2492 Critical 9.2 An improper authentication control vulnerability exists in AiCloud. This vulnerability can be triggered by a crafted request, potentially leading to unauthorized execution of functions. Refer to the 1.1%
• CVE-2024-13062 High 7.2 An unintended entry point vulnerability has been identified in certain router models, which may allow for arbitrary command execution. Refer to the ' 01/02/2025 ASUS Router AiCloud vulnerability' sect 1.0%
• CVE-2024-12912 High 7.2 An improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution. Refer to the '01/02/2025 ASUS Router AiCloud vulnerability' section on the ASUS S 1.2%