Asus Router
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Asus Router.
By the Year
In 2026 there have been 11 vulnerabilities in Asus Router with an average score of 8.3 out of ten. Last year, in 2025 Router had 9 security vulnerabilities published. That is, 2 more vulnerabilities have already been reported in 2026 as compared to last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 11 | 8.31 |
| 2025 | 9 | 0.00 |
It may take a day or so for new Router vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Asus Router Security Vulnerabilities
CVE-2026-75753: Missing Auth for Critical HTTP Func in ASUS Routers
CVE-2026-75753
5.3 - Medium
- October 20, 2026
Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to return device identification information and switch into a specific mode. As a result, when the router encounters abnormal conditions, it may be unable to perform self-recovery. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
Missing Authentication for Critical Function
ASUS Router Buffer Copy (No Size Check) Enables Adjacent Authenticated DoS
CVE-2026-17518
8.2 - High
- October 20, 2026
Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
Stack Overflow
ASUS Router XSS in Web Page Generation (CVE-2026-14911)
CVE-2026-14911
9.3 - Critical
- October 07, 2026
Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
XSS
Predictable PRNG seed in ASUS RT-BE57 IFTTT pairing token
CVE-2026-19396
7.7 - High
- October 07, 2026
A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and read or modify router settings via observed values from an administrator-initiated IFTTT pairing session.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
PRNG
ASUS Router Firmware Stack Buffer Overflow via Config Upload
CVE-2026-19386
9.3 - Critical
- October 07, 2026
A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
Stack Overflow
ASUS Router Log Injection Exposes DDNS Credentials
CVE-2026-16528
8.4 - High
- October 07, 2026
Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, potentially enabling modification of DNS settings.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
Insertion of Sensitive Information into Log File
CVE-2026-13313: ASUS Router Debug Code Bypass Enables Telnet Root Access
CVE-2026-13313
8.9 - High
- October 01, 2026
An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby executing arbitrary commands with root privileges and potentially affecting other devices connected to the router. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
Active Debug Code
ASUS Router Format String Vulnerability Enables Remote Command Execution
CVE-2026-14157
9.4 - Critical
- October 01, 2026
Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface.
Use of Externally-Controlled Format String
ASUS Router Remote MITM Arbitrary Code via Improper Cert/Integrity Validation
CVE-2026-13385
- July 15, 2026
An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middle(MITM) user to make the router download and execute arbitrary command via a spoofed server. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
Improper Validation of Integrity Check Value
ASUS Router SQLi via Web Mgr Auth Bypass Disclosure
CVE-2026-11851
- July 15, 2026
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certain ASUS router models allows a remote authenticated user to disclose confidential information via a crafted request that bypasses existing input validation Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
SQL Injection
ASUS Router Web UI CSRF Enables Authenticated Privilege Actions
CVE-2025-15101
- March 26, 2026
An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrators to execute arbitrary system commands via a crafted parameter. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
Shell injection
ASUS Router Firmware Path Traversal for Authenticated File Write
CVE-2025-59372
- November 25, 2025
A path traversal vulnerability has been identified in certain router models. A remote, authenticated attacker could exploit this vulnerability to write files outside the intended directory, potentially affecting device integrity. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
Directory traversal
AUTH Bypass in Asus Router IFTTT Integration Remote Auth Attacker Access
CVE-2025-59371
- November 25, 2025
An authentication bypass vulnerability has been identified in the IFTTT integration feature. A remote, authenticated attacker could leverage this vulnerability to potentially gain unauthorized access to the device. This vulnerability does not affect Wi-Fi 7 series models. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
Use of Insufficiently Random Values
Command Injection in ASUS bwdpi Router Firmware
CVE-2025-59370
- November 25, 2025
A command injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbitrary commands, leading to the device executing unintended instructions. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
Shell injection
CVE-2025-59369: Authenticated SQLi in bwdpi of ASUS Router
CVE-2025-59369
- November 25, 2025
A SQL injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbitrary SQL queries, leading to unauthorized data access. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
SQL Injection
Integer Underflow in Aicloud (ASUS Router) Enables DoS
CVE-2025-59368
- November 25, 2025
An integer underflow vulnerability has been identified in Aicloud. An authenticated attacker may trigger this vulnerability by sending a crafted request, potentially impacting the availability of the device. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
Integer underflow
ASUS Router WebDAV Path Traversal VULN Affects Device Integrity
CVE-2025-12003
- November 25, 2025
A path traversal vulnerability has been identified in WebDAV, which may allow unauthenticated remote attackers to impact the integrity of the device. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
Missing Authentication for Critical Function
Auth Stack Buffer Overflow in ASUS Router Firmware
CVE-2025-59365
- November 25, 2025
A stack buffer overflow vulnerability has been identified in certain router models. An authenticated attacker may trigger this vulnerability by sending a crafted request, potentially impacting the availability of the device. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
Stack Overflow
Auth Bypass in ASUS AiCloud via Samba Functionality
CVE-2025-59366
- November 25, 2025
An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba functionality, potentially leading to allow execution of specific functions without proper authorization. Refer to the Security Update for ASUS Router Firmware section on the ASUS Security Advisory for more information.
Directory traversal
ASUS AiCloud Improper Auth Flaw
CVE-2025-2492
- April 18, 2025
An improper authentication control vulnerability exists in AiCloud. This vulnerability can be triggered by a crafted request, potentially leading to unauthorized execution of functions. Refer to the 'ASUS Router AiCloud vulnerability' section on the ASUS Security Advisory for more information.
Authentication Bypass Using an Alternate Path or Channel
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Asus Router or by Asus? Click the Watch button to subscribe.
