ASUS Router Firmware CVE-2026-16528

Exploitation requires that the attacker already possess high-privilege authenticated access to the router's management interface (PR:H) AND network adjacency to the device (AV:A, e.g., same LAN/Wi-Fi segment or a logically adjacent network), not arbitrary internet-facing access. The specific prerequisite is that the affected ASUS router firmware writes DDNS credentials into the readable system log (CWE-532), which presupposes the DDNS feature is configured/enabled on the device - routers without DDNS configured would have no such credentials to leak. Limiting factors: the required administrative authentication and local-network positioning sharply narrow the realistic attacker set and make remote mass exploitation impractical.

This is a moderate-priority, context-dependent issue rather than a broadly exploitable crisis, despite its 8.4 (High) CVSS 4.0 score. The vendor-supplied vector (AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L) shows two significant gating factors: AV:A means the attacker must be on the adjacent/local network (not arbitrary internet-wide access), and PR:H means they must already hold high-privilege authenticated access to the router. The high confidentiality and integrity impacts (VC:H/VI:H) reflect disclosure of DDNS credentials and consequent ability to alter DNS settings, which is serious, but the PR:H precondition substantially limits the attacker population to those who already have administrative access. No EPSS score, CISA KEV listing, or POC is provided in the intelligence, so there is no evidence of active or at-scale exploitation - the risk here is driven by impact severity, not by exploitation likelihood. The main tension to flag: CVSS marks this High largely on impact, but the combination of adjacent-network access plus high privileges makes mass exploitation unlikely; this is more a privilege-escalation/lateral-value finding than a remote-takeover emergency. Exploitation status: no public exploit identified at time of analysis.

An attacker who already has authenticated administrative access to an affected ASUS router, and who is positioned on the adjacent local network, reads the device's system log where DDNS credentials have been improperly recorded in cleartext. With those recovered credentials the attacker can log into the DDNS service and modify DNS settings, redirecting the domain to attacker-controlled infrastructure. No public exploit code is identified at time of analysis.