ASUS Router Firmware EUVD-2026-108610

Exploitation requires the ASUS router to be in its factory-default state (as explicitly stated in the description), and the attacker must have adjacent-network access per CVSS AV:A - i.e. be on the same LAN/Wi-Fi segment or an adjacent logical network, not the public internet. No authentication is required (PR:N) and no user interaction is needed (UI:N), so any device reachable on that local segment while unconfigured is at risk. The primary limiting factors are: (1) the factory-default-state requirement, meaning routers already through initial setup/configuration are outside the described condition; and (2) the adjacency requirement, which excludes remote internet-based attackers unless they first obtain a foothold on the local network. The AT:P metric reflects that the factory-default state is a precondition not under the attacker's control. The specific vulnerable parameter/endpoint and the exact trigger are not described in the available sources.

Signals are mixed and point to a real-but-bounded priority rather than an emergency. The CVSS 4.0 base score of 7.7 (High) reflects full technical impact - VC:H/VI:H/VA:H with root-level arbitrary command execution - but the attack surface is constrained by AV:A (adjacent network, i.e. an attacker already on the LAN/Wi-Fi segment, not the open internet) and AT:P, indicating an attacker-uncontrolled precondition that the description identifies as the device being in its factory-default state. PR:N confirms no authentication is required. No EPSS score was provided, so statistical exploitation probability is unknown. There is no CISA KEV listing and no proof-of-concept or exploit reference in the input (only the ASUS advisory landing page), so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_week,' consistent with a High-severity authless root flaw that is nonetheless gated by adjacency and a transient configuration state rather than being remotely internet-exploitable. Net: a genuine issue warranting prompt patching within the week, but not an internet-wide mass-exploitation scenario given the adjacent vector and factory-default requirement.

An attacker with access to the local network segment - for example on the same Wi-Fi or LAN as a freshly reset or newly-provisioned ASUS router still in its factory-default state - sends crafted parameters to the device that are passed unsanitized into an OS command, gaining root-level command execution without authentication. No public exploit code is identified at time of analysis, so this reflects the described mechanism rather than a confirmed working PoC. Because the device is in factory-default state, this is most realistic during initial setup, after a reset, or in staging/provisioning environments.