ASUS Router Firmware CVE-2026-19386

Exploitation requires three concrete prerequisites drawn from the description and CVSS vector: (1) the attacker must already possess high-privilege/administrative access to the router (PR:H) - this is an authenticated flaw, not pre-auth; (2) the attacker must be network-adjacent (AV:A), i.e. on the same local/Wi-Fi segment rather than reaching the device across the open Internet; and (3) the attacker must be able to submit a crafted configuration file through the router's upload mechanism whose size exceeds the expected buffer. The limiting factors are therefore the admin-credential requirement and the adjacent-network constraint, which together exclude anonymous Internet-wide attack; no end-user interaction is required (UI:N) once those conditions are met.

The CVSS 4.0 base score of 9.3 (Critical) is driven largely by the uniform High impact metrics (VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H) combined with low attack complexity, but two metrics meaningfully constrain real-world risk: AV:A means the attacker must be network-adjacent (same LAN/Wi-Fi segment, not routable Internet access) and PR:H means the attacker must already hold high-privilege (administrative) credentials on the router. This is therefore a post-authentication, adjacent-access code-execution flaw rather than a drive-by remote takeover, which tempers the headline score. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation would require chaining with credential theft or an authentication bypass to be impactful against a hardened device. Net assessment: a genuinely serious vulnerability where exploitable (full device compromise), but the PR:H + AV:A prerequisites make it a lower immediate priority than a comparably-scored unauthenticated remote flaw - patch promptly but it is not a wormable emergency on its own.

An attacker who has gained administrative access to an ASUS router and sits on an adjacent network segment uploads a maliciously crafted configuration file whose contents exceed the expected buffer size, triggering a stack-based buffer overflow (CWE-121) in the router's handling module. By controlling the overflow contents the attacker overwrites the stack and executes arbitrary code on the device, taking full control of the router. No public proof-of-concept was provided in the input.