ASUS Router CVE-2026-14911

Exploitation requires that a legitimate ASUS router administrator is already authenticated to the router's web management interface AND is induced to visit an attacker-crafted URL (UI:P / user interaction). The attacker needs no credentials of their own, but the payload only executes within the victim's existing authenticated session, so it cannot be triggered against a router with no logged-in admin. Limiting factors: dependence on social engineering to deliver the crafted URL, the need for a concurrently active admin session, and exposure of the management interface to the context in which the victim browses; no non-default configuration is stated as required. Specific affected firmware versions are not enumerated in the provided data.

This is a CWE-79 cross-site scripting flaw in ASUS router web-management modules carrying a vendor-assigned CVSS 4.0 base score of 9.3 (Critical). The supplied vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H indicates a network-reachable, low-complexity attack needing no attacker privileges but requiring passive user interaction (UI:P) - consistent with the description's 'when an authenticated user visits a crafted URL.' Importantly, PR:N refers to the ATTACKER needing no credentials, while the DESCRIPTION makes clear the VICTIM must be an authenticated router user with an active admin session; these are not contradictory but defenders should understand the real precondition is a logged-in admin clicking a hostile link. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 9.3 is a theoretical-impact score, not an observed-exploitation signal. The high VI/VA (ability to modify router settings and cause DoS) justifies prioritization because router compromise can pivot to the whole network, but the UI:P requirement and dependence on an authenticated victim session materially lower practical likelihood versus a true zero-click unauthenticated RCE. Net: patch promptly given the device class and impact, but treat as 'high-impact, interaction-gated' rather than 'mass-exploitable right now.'

An attacker crafts a malicious URL and lures a router administrator - via phishing email, malicious webpage, or chat - into clicking it while logged into the ASUS router's web interface. The injected script executes in the admin's authenticated session context, letting the attacker read DOM data, silently alter router configuration, or crash the management interface (DoS). No public exploit code was identified in the provided data, and the attack hinges on the victim already being authenticated and performing the click (UI:P).