ASUS Router App EUVD-2026-41482

Exploitation requires a malicious third-party application to be installed on the same Android device as the ASUS Router App - remote network exploitation is not possible given the AV:L attack vector. The attacking application does not require elevated Android permissions to send Intents to explicitly exported components, so no special app capabilities are needed. Passive user interaction (UI:P in CVSS 4.0) is required, meaning the ASUS Router App must be in a state where it processes the incoming Intent, though the precise trigger condition (e.g., app foregrounded vs. background handling) is not specified in available data. No specific ASUS Router App feature needs to be enabled beyond the app being installed. Exploitation is limited to devices where users have installed an untrusted or malicious companion application; devices restricted to verified Play Store applications from trusted publishers have a substantially reduced risk profile.

The CVSS 4.0 score of 6.0 with vector AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N characterizes this as a local-vector, low-complexity attack with no impact on the ASUS Router App itself (VC/VI/VA all N), but high subsequent-system confidentiality impact (SC:H), reflecting the potential to expose router credentials or sensitive management data through URL manipulation. Real-world risk is moderate at most: the local attack vector is the defining constraint - this is not remotely exploitable and requires a malicious application to already be installed on the victim's device. The subsequent-system confidentiality impact (SC:H) elevates the score but depends entirely on the victim interacting with attacker-controlled content rendered within the app. No EPSS data is available in the provided intelligence, no active exploitation is confirmed (not in CISA KEV), and no public POC has been identified - making this a theoretical-but-credible threat rather than an active one. The niche deployment footprint of a home-router companion app further limits aggregate exposure.

A threat actor publishes a malicious Android application - disguised as a utility, game, or productivity tool - to a third-party app store or distributes it via social engineering. Once installed on the same Android device running the ASUS Router App, the malicious app sends a crafted Android Intent to the improperly exported component, causing the ASUS Router App to open an attacker-controlled URL. The victim, seeing the content rendered within the trusted ASUS Router App interface, may be deceived into submitting router admin credentials or other sensitive data to the attacker's server.