EUVD-2026-44590
GHSA-f3gg-32xv-8j76
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector but the required MITM position makes AC:H; no auth or interaction (PR:N/UI:N); executing attacker code on the router crosses into managed systems, so S:C with full C/I/A impact.
Primary rating from Vendor (ASUS).
CVSS VectorVendor: ASUS
Lifecycle Timeline
2DescriptionCVE.org
An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middle(MITM) user to make the router download and execute arbitrary command via a spoofed server. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
AnalysisAI
Remote command execution in certain ASUS router firmware allows a network man-in-the-middle attacker to force the router to download and run arbitrary commands from a spoofed update/download server. The root cause is a failure to validate both the integrity check value (CWE-354) and the TLS server certificate, so an attacker positioned in the network path can impersonate a legitimate ASUS server. No public exploit identified at time of analysis and the flaw is not in CISA KEV; ASUS self-reported it and rates it critical (CVSS 4.0 9.5), though exploitation requires the attacker to first achieve a MITM position (AT:P).
Technical ContextAI
The affected component is the firmware/update-retrieval or provisioning routine on ASUS consumer and SMB routers (CPE cpe:2.3:a:asus:router). The vulnerability class is CWE-354, Improper Validation of Integrity Check Value, compounded by improper certificate validation: the router fetches server-supplied content (firmware or command payloads) but does not cryptographically verify the authenticity of the peer or the integrity of the delivered data. Because the TLS certificate chain is not properly validated, an on-path attacker can present a spoofed or self-signed certificate and substitute malicious content, which the router then trusts and executes. This is the classic failure mode of client-side update mechanisms that rely on transport security without pinning or signature verification.
RemediationAI
Patch available per vendor advisory: apply the fixed firmware listed in the 'Security Update for ASUS Router Firmware' section of the ASUS Security Advisory at https://www.asus.com/security-advisory/ (exact fixed firmware version not specified in the provided data - confirm the build for your specific model on that page). Until firmware can be updated, reduce exposure to man-in-the-middle conditions: avoid administering or updating the router over untrusted networks, ensure the router's update/provisioning traffic egresses only over trusted upstream links, and use trustworthy DNS resolvers to lower the chance of an attacker redirecting the router to a spoofed server (trade-off: does not close the vulnerability, only shrinks the opportunity window). Disable remote/WAN-side management and cloud/auto-update features that reach out to external servers if they are not required (trade-off: loss of remote administration and automatic updates), and segment the router's management plane from untrusted clients.
Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated
The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Web management interface of ASUS router models that allo
Command injection in TRENDnet Router firmware 1.1.02b01 allows authenticated remote attackers to execute arbitrary OS co
SQL injection in the web management interface of multiple ASUS router models enables a remotely authenticated, high-priv
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today