EUVD-2026-41482
GHSA-6vqf-8qmc-rjr8
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector as exploitation requires co-installed malicious app; PR:N because attacking app needs no special privileges; S:C and C:H reflecting potential router credential exposure beyond the app boundary.
Primary rating from Vendor (ASUS).
CVSS VectorVendor: ASUS
Lifecycle Timeline
2DescriptionCVE.org
An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to send a crafted Intent that causes ASUS Router App to open an specified URL. Refer to the ' Security Update for ASUS Router Android App ' section on the ASUS Security Advisory for more information.
AnalysisAI
Improper export of Android application components in the ASUS Router App enables any co-installed third-party application on the same Android device to send a crafted Intent that forces the ASUS Router App to navigate to an attacker-specified URL. The flaw, classified as CWE-926, allows an attacker-controlled application to abuse the exposed component as an open redirect, potentially rendering phishing content or harvesting router management credentials within the app's trusted interface context. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Technical ContextAI
Android application components - Activities, Services, BroadcastReceivers, and ContentProviders - can be declared as 'exported' in an app's AndroidManifest.xml, making them addressable by other applications on the device via Android Intents. CWE-926 (Improper Export of Android Application Components) captures scenarios where these components lack adequate access controls or permission enforcement, allowing arbitrary third-party apps to invoke them. In this case, the ASUS Router App exports a component that accepts an Intent carrying a caller-supplied URL, then opens that URL - most likely inside a WebView or embedded browser - without validating the URL's origin or trustworthiness. The affected product is identified by CPE cpe:2.3:a:asus:router_app:*:*:*:*:*:*:*:*, indicating all known versions of the ASUS Router Android application are in scope. The 'Google' and 'Router App' tags confirm this is a Google Play-distributed companion application for ASUS home networking hardware.
RemediationAI
The primary remediation is to update the ASUS Router App to the patched version available through the Google Play Store, as directed by the ASUS Security Advisory at https://www.asus.com/security-advisory/. A specific fixed version number is not confirmed in the available intelligence - the exact patch version must be verified in the ASUS advisory before deployment. As a compensating control prior to patching, users should avoid installing unverified or sideloaded third-party applications on any Android device that also runs the ASUS Router App, since exploitation strictly requires a malicious co-installed application to be present. Disabling 'Install from unknown sources' in Android settings eliminates the sideloading attack surface without affecting Play Store apps, though it does not guard against malicious apps distributed via the Play Store itself. On shared or untrusted devices, removing the ASUS Router App entirely is the most effective risk mitigation.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today