Router EUVD-2025-209041

Despite the absence of official CVSS scoring and EPSS data, this vulnerability warrants high priority assessment due to several risk indicators: (1) Attack vector is network-based and requires minimal complexity-only that an administrator visit an attacker-controlled page while authenticated to their router; (2) Technical impact is severe, enabling command execution on network infrastructure; (3) ASUS routers are ubiquitous in residential and small business environments, providing broad attack surface; (4) The CWE-352 classification indicates a well-understood and reliably exploitable weakness; (5) No KEV or POC availability is mentioned, but the simplicity of CSRF exploitation means weaponization requires minimal effort. This is not a low-priority issue-the absence of CVSS data should not diminish response urgency given the severity of impact and ease of exploitation.

An attacker creates a malicious webpage containing embedded requests to the victim's router management interface (e.g., http://192.168.1.1/admin). When an authenticated router administrator visits the attacker's page in their browser, the CSRF vulnerability allows the attacker's requests to execute with the administrator's session privileges, potentially modifying network settings, creating backdoor accounts, or executing arbitrary system commands on the router. No POC is mentioned as publicly available, but CSRF exploitation is straightforward and does not require sophisticated techniques-simple HTML forms or JavaScript fetch requests are typically sufficient.