ASUS Router EUVD-2026-116688

Exploitation requires network adjacency (AV:A): the attacker must be on the same local/L2 network segment or within wireless range of the router, not reaching it over the internet - this proximity requirement is the primary limiting factor. The flaw is triggered via a crafted device name against affected ASUS router firmware, and the advisory references the AiCloud feature, so the vulnerable code path is plausibly tied to that feature set - though the input does not confirm whether AiCloud must be explicitly enabled, so that conditionality is unverified. Within reach, no authentication (PR:N), no user interaction (UI:N), and low complexity (AC:L) are needed. Exact vulnerable firmware versions/models are not enumerated in the available data.

This is a genuine high-priority flaw, though several real-world constraints temper the raw score. The input CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes an adjacent-network, low-complexity, unauthenticated attack with no user interaction yielding full high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H) - consistent with the description's claim of arbitrary command execution as root. The decisive limiter is AV:A (adjacent, not network): the attacker must be 'nearby' - on the same local/L2 segment or within wireless range - not on the open internet, which sharply narrows the realistic attacker population versus a comparable AV:N router bug. On the decision signals: the vuln.today priority label is 'this_week' (not act_now/emergency). No EPSS score, no CISA KEV listing, and no SSVC automatable/exploitation fields were supplied, so exploitation probability cannot be quantified from the input. No proof-of-concept or exploit reference is present either - only a generic ASUS advisory link. So the signals are moderately consistent: serious technical impact and trivial complexity, but gated by physical/network proximity and with no evidence yet of active exploitation or public exploit code. Treat it as a prompt-patch item for exposed/multi-tenant networks rather than an internet-wide emergency; the 'this_week' label aligns with that reading.

An attacker within the router's local or wireless network range (for example on a shared/guest Wi-Fi or an untrusted LAN segment) sends a crafted device name to a vulnerable ASUS router running the affected firmware, overflowing a stack buffer and executing arbitrary commands as root without any credentials or user interaction. Given AV:A and AC:L, the attack is low-complexity but requires network adjacency, not internet reachability. No public exploit code is referenced in the available data.