ASUS Router EUVD-2026-44590

Requires the attacker to hold a man-in-the-middle position on the network path between the router and the ASUS server it contacts for downloads/updates (this is the AT:P attack requirement in the CVSS 4.0 vector). Given that position, no authentication (PR:N) and no user interaction (UI:N) are needed. The specific enabling weaknesses are the router's failure to validate the server's TLS certificate and its failure to validate the integrity check value of downloaded content, so a spoofed server can supply arbitrary commands. Limiting factors: exploitation is confined to the affected ASUS router models (specific models/firmware per the ASUS advisory), and the requirement to intercept and spoof the server connection means an attacker with no on-path capability cannot exploit this remotely against an arbitrary Internet-facing device.

Signals are mostly aligned toward high priority but with an important caveat. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, all impacts High, subsequent-system impacts High) yields 9.5 critical, reflecting unauthenticated network access with full compromise of confidentiality, integrity, and availability and a scope-crossing effect on connected systems. The decisive limiter is AT:P (Attack Requirements: Present) - the attacker must already occupy a man-in-the-middle position, which is non-trivial on the WAN side but realistic on shared or hostile local networks, or via upstream DNS/route hijacking. There is no EPSS score, no POC, and no KEV listing provided, so there is currently no evidence of active or automated exploitation despite the critical rating. This is therefore a genuinely dangerous flaw for exposed or hostile-network deployments, but the MITM precondition makes opportunistic mass exploitation less likely than the raw 9.5 suggests. Note: input CVSS is 4.0 only; no CVSS 3.1 vector was supplied, and affected firmware versions are not enumerated in the provided data.

An attacker who has gained an on-path position - for example on a shared Wi-Fi network, a compromised upstream hop, or via DNS/route hijacking - intercepts the router's connection to an ASUS server. Because the router does not properly validate the server certificate or the integrity of the returned payload, the attacker presents a spoofed server and delivers a malicious command or firmware image, which the router downloads and executes with full privileges. No public POC is reported, and success depends on the attacker first achieving the MITM position (AT:P) rather than on any user interaction.