ASUS Router CVE-2026-93489

Exploitation requires the attacker to be on an adjacent network to the router (AV:A) - such as an associated Wi-Fi client or a device on the same local LAN segment - rather than arriving from the public Internet; purely remote Internet exploitation is not indicated by the vector. Within that position, no authentication is required (PR:N) and no user interaction is needed (UI:N): the attacker sends an HTTP request to the router's management service and forges an access ticket to bypass authentication, then performs administrator operations. The primary limiting factor is therefore network adjacency; the specific affected router models, firmware versions, and whether any non-default configuration is required are not stated in the available sources (wildcard CPE and generic advisory reference).

Signals are moderately consistent and point to a genuine but bounded priority. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes a low-complexity, unauthenticated, no-interaction authentication bypass with full high confidentiality, integrity and availability impact to the router itself (VC:H/VI:H/VA:H, no scope change) - severity 8.7. The single most important caveat is AV:A (Adjacent): the attacker must be on the same local/adjacent network segment (e.g. the router's Wi-Fi or LAN), NOT the public Internet, which is why this is not a 9.x fully-remote flaw and why mass Internet-wide exploitation is unlikely. No EPSS score, no CISA KEV listing, and no PoC/exploit reference were provided, so there is no evidence of active or automated exploitation at this time. The vuln.today decision label is 'this_week', consistent with a serious-but-not-emergency item: an unauthenticated local admin takeover of a widely deployed consumer router that should be patched promptly but is not a drop-everything KEV event. Conflicting/missing data to note explicitly: the reference is a generic ASUS advisory landing page with no specific fixed firmware versions or affected-model list in the supplied data, and the CPE is a wildcard (cpe:2.3:a:asus:router:*), so exact affected versions are not confirmed - verify the precise models and fixed firmware on the ASUS Security Advisory.

An attacker who is adjacent to the target - for example connected to the same Wi-Fi network or local LAN segment as an ASUS router - sends a specially crafted HTTP request to the router's management interface and forges a valid access ticket, bypassing authentication. With the forged ticket the attacker performs administrator operations such as changing settings, DNS, credentials, or firmware. No public exploit identified at time of analysis.