ASUS Router Firmware CVE-2026-17518

Exploitation requires the attacker to be positioned on the adjacent/local network segment (AV:A - e.g., connected to the router's LAN or Wi-Fi, not reachable from the internet) AND to already possess high-privilege administrative authentication to the router's web interface (PR:H). With those preconditions met, the attacker sends an HTTP request to the management interface containing an input field longer than the expected length, triggering the stack buffer overflow. Limiting factors that reduce realistic risk: no remote/internet exploitation, no unauthenticated access, and the required admin privilege level is the same level needed to reboot or reconfigure the device anyway; impact is confined to denial of service / operational corruption (no confidentiality loss). Specific affected models and firmware versions are not enumerated in the provided advisory reference.

The input CVSS 4.0 base score of 8.2 (High) is driven by high integrity and availability impact (VI:H/VA:H/SA:H), but two metrics meaningfully constrain real-world risk: AV:A means the attacker must be on the adjacent/local network (LAN or Wi-Fi, not the public internet), and PR:H means the attacker must already hold high-privilege (administrative) access to the router. An admin-authenticated adjacent attacker is a high bar, and such an actor can typically already reboot or reconfigure the device, which blunts the practical value of a DoS primitive. There is no confidentiality impact (VC:N), and the outcome is corruption/denial of service rather than code execution or data theft per the description. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation - this reads as a high-CVSS-but-moderate-real-priority issue rather than an urgent threat. Note a tension: the CWE-121 (stack buffer overflow) and tags suggest a memory-corruption primitive that could theoretically exceed DoS, but the vendor description explicitly scopes impact to corruption of device operations and denial of service only; treat RCE potential as unconfirmed.

An attacker who has already obtained administrative credentials to an affected ASUS router and who sits on the same local/adjacent network sends a crafted HTTP request to the router's web management interface with a field exceeding the expected length. This overflows a fixed-size stack buffer (CWE-121), corrupting device operations and crashing the service, resulting in denial of service. No public exploit code was identified at time of analysis.