EUVD-2026-90453
GHSA-j8q5-whhx-5847
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote web interface (AV:N) but requires authenticated router admin (PR:H); format-string RCE escapes the web app to OS commands (S:C) with full CIA impact.
Primary rating from Vendor (ASUS).
CVSS VectorVendor: ASUS
Lifecycle Timeline
4DescriptionCVE.org
Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface.
AnalysisAI
Authenticated administrators of ASUS routers can execute arbitrary commands on the device by uploading a crafted file through the web-based management interface that is subsequently processed with an attacker-influenced format string by a vulnerable router module (CWE-134). The vendor's CVSS 4.0 score of 9.4 (Critical) reflects complete loss of confidentiality, integrity, and availability on the vulnerable component plus a scope change, but exploitation is gated by a pre-existing high-privilege administrator session per the PR:H vector metric, so exposure depends on whether the management interface is reachable by the attacker (WAN-exposed remote administration versus LAN-only) and on the strength of admin credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated, high-privilege (administrator) session on the ASUS router's web-based management interface, and the ability to upload a crafted file through that interface which is then processed by a vulnerable router module. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 score of 9.4 (Critical) reflects full compromise of the vulnerable system plus a scope change (VC:H/VI:H/VA:H + SC:H/SI:H/SA:H) via an externally controlled format string (CWE-134) that yields arbitrary command execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | There is no vendor-released fix version enumerated in the available data, so patch status must be confirmed directly against the ASUS security advisory at https://www.asus.com/security-advisory, which is the authoritative source for the affected-model list and the corresponding fixed firmware builds; the immediate action is to check the router's model against that advisory and apply the newest firmware ASUS publishes for it, and where no fixed firmware is listed yet, to treat the device as unpatched. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every ASUS router in the environment and determine which ones expose the web-based management interface to the WAN or to untrusted network segments; disable remote/WAN administration on all of them and restrict management access to a trusted LAN segment or VPN, then rotate the administrator credentials on every device, enforce long unique passphrases, and remove any default, shared, or stale admin accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote attackers can enable Telnet on TOTOLINK X5000R AX1800 routers running firmware V9.1.0u.6369_B2023
Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated
OS command injection in Netcore NAP930 firmware 0.1.241010.141410 allows unauthenticated remote attackers to execute arb
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers e
Missing authorization in Netcore NBR100V2 firmware 1.3.240614.030928 allows remote unauthenticated attackers to modify d
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and ab
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can
A stack-based buffer overflow in the devdiscover service of FAST FAC1900R firmware 20190827_2.0.2 lets unauthenticated r
Unauthenticated OS command injection in the Netcore NBR200V2 router's Web Management Interface (firmware 1.3.241127.0712
Authenticated administrators of certain ASUS router models can abuse leftover debug code in the device's web management
Unauthenticated remote stack-based buffer overflow in the Netcore NR289-GE router (firmware 1.4.5102) lets an attacker c
Same weakness CWE-134 – Use of Externally-Controlled Format String
View allShare
External POC / Exploit Code
Leaving vuln.today