ASUS Router Firmware EUVD-2026-108608

Exploitation requires an administrator to be actively logged in to the router's web management interface AND to be tricked into visiting an attacker-controlled phishing page in the same browser (UI:A). The CSRF component means the attacker needs no credentials of their own, but a valid authenticated admin session on the victim side is a hard prerequisite - this is the primary limiting factor and significantly narrows realistic attacks compared to a fully unauthenticated RCE. The specific router models, firmware versions, and whether any non-default configuration is needed are not stated in the available sources; the description does not describe the exact command-injection trigger or the vulnerable endpoint.

This is a CVSS 4.0 8.6 (high) flaw combining CSRF with OS command injection (CWE-78) in ASUS routers, yielding root-level arbitrary command execution. The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A shows a network-reachable, low-complexity attack that requires no attacker privileges but DOES require active user interaction (UI:A) - specifically a logged-in administrator being lured to an attacker-controlled page. Because PR:N reflects that the attacker holds no credentials while the CSRF mechanism still depends on the victim having an authenticated router session, the practical precondition is an authenticated admin, not a truly unauthenticated remote takeover. The vuln.today decision label is 'this_week', indicating elevated but not emergency urgency. No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the input, so there is no public evidence of active exploitation or available exploit code; the real-world risk is driven by impact severity (root on the device) and the broad consumer deployment base rather than by any observed exploitation signal. The single reference is a generic ASUS advisory landing page (no model list, no fixed-version detail in the input), which limits independent verification.

An attacker crafts a malicious or phishing web page containing a forged request targeting the router's administrative interface. A network administrator who is currently logged in to the ASUS router visits that page, and the browser silently submits the CSRF request, causing the router to execute attacker-supplied OS commands as root. No public exploit code or PoC reference is provided in the available sources.