ASUS Router Firmware EUVD-2026-104784

Exploitation requires the attacker to be on the same adjacent network as the router (CVSS AV:A - e.g. the local LAN or Wi-Fi broadcast domain), reflecting the description's 'nearby user'; it is NOT reachable from the broader internet by default. Within that proximity, no authentication (PR:N) or user interaction (UI:N) is needed - the attacker simply sends specific commands via HTTP to a critical function that lacks authentication, retrieving device identification information and forcing a mode switch. The limiting factors are the adjacency requirement and the low impact: the outcome is information disclosure plus a state change that may prevent the router from self-recovering under abnormal conditions, not full compromise. Affected models/firmware are not enumerated in the available data, so confirm applicability against the ASUS advisory.

This is a genuinely medium-severity (CVSS 5.3) issue, not a false high - all signals point to limited real-world risk. The CVSS 4.0 vector shows AV:A (Adjacent), meaning exploitation requires the attacker to be on the same local/adjacent network segment (the description's 'nearby user'), not the open internet, which substantially narrows the threat surface to co-located actors (e.g. same Wi-Fi or LAN). PR:N/UI:N confirms no authentication or user interaction is needed once adjacency is achieved, and AC:L/AT:N indicate a simple, reliable trigger. However, impacts are uniformly Low (VC:L/VI:L/VA:L): the vulnerability leaks device identification information and forces a mode switch that can impair the router's self-recovery under abnormal conditions, rather than granting code execution or full device takeover. No EPSS score, KEV listing, or POC is present in the provided data, so there is no evidence of active or probable exploitation - exploitation status is 'no public exploit identified at time of analysis.' The adjacent-only vector combined with low technical impact means this should be patched in normal maintenance cycles rather than treated as an emergency.

An attacker on the same adjacent network as a vulnerable ASUS router (for example, a guest or compromised host on the local LAN/Wi-Fi) sends crafted HTTP requests to an unauthenticated critical function, causing the router to disclose device identification details and switch into a specific operating mode. No public exploit code is identified at the time of analysis, and because the vector is adjacent rather than internet-facing, the attacker must already have local network proximity.