ASUS Router CVE-2026-11851

Q: What is the CVSS score of CVE-2026-11851?

CVE-2026-11851 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-44584 MEDIUM

SQL Injection (CWE-89)

2026-07-15 ASUS

GHSA-f2xq-6hc9-3p2f

SQLi Router Asus

5.9

CVSS 4.0 · Vendor: ASUS

Severity by source

Vendor (ASUS) PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.4 MEDIUM

Network-accessible management interface requires admin authentication (PR:H) and active validation bypass (AC:H); impact is confidentiality-only with no scope change.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ASUS).

CVSS VectorVendor: ASUS

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 02:31 vuln.today

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certain ASUS router models allows a remote authenticated user to disclose confidential information via a crafted request that bypasses existing input validation Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

AnalysisAI

SQL injection in the web management interface of multiple ASUS router models enables a remotely authenticated, high-privilege user to exfiltrate confidential information by sending crafted requests that bypass the router's existing input validation. The vulnerability is limited to read-only data disclosure (no integrity or availability impact) and requires prior administrative authentication, significantly constraining real-world exploitability. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 5.9 reflects the high complexity and authentication prerequisites.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-89) embedded within the HTTP request-handling logic of the ASUS router web management interface. SQL injection arises when user-controlled input is interpolated into database query strings without adequate parameterization or escaping, allowing alteration of query semantics. Notably, the description specifies that existing input validation is present but insufficient - the exploit requires crafting a payload that specifically circumvents those defenses, consistent with the AC:H rating. The CPE string (cpe:2.3:a:asus:router:*:*:*:*:*:*:*:*) uses full wildcards on version, indicating ASUS has not publicly scoped the vulnerability to a single firmware branch - multiple router product lines are implicated. The CVSS 4.0 impact metrics (VC:H, VI:N, VA:N, SC:N, SI:N, SA:N) indicate the exploitable database contains sensitive data but that writes or denial-of-service through this vector are not possible, consistent with a read-only SQL query abuse scenario.

RemediationAI

Apply the firmware updates identified in the ASUS Security Advisory ('Security Update for ASUS Router Firmware' section) at https://www.asus.com/security-advisory/ - this is the only confirmed fix, and exact patched firmware versions must be obtained directly from ASUS since no specific version number is available in current source data. As a compensating control, immediately disable WAN-side (remote) web management access if not operationally required - this removes the network-reachable attack surface entirely for external attackers, though it does not protect against authenticated internal threats. Restrict management interface access to a dedicated management VLAN or specific trusted IP ranges using the router's access control settings. Enforce strong, unique administrative credentials and review which accounts hold high-privilege access, removing unnecessary admin accounts. Note that restricting network access to the management interface does not remediate the underlying SQL injection flaw - patching remains the authoritative fix.