EUVD-2026-90454
GHSA-m5g8-55x2-4988
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable management interface but requires admin privileges (PR:H) and non-trivial crafting (AC:H); root RCE gives full CIA, and impact on other connected devices justifies S:C.
Primary rating from Vendor (ASUS).
CVSS VectorVendor: ASUS
Lifecycle Timeline
3DescriptionCVE.org
An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby executing arbitrary commands with root privileges and potentially affecting other devices connected to the router. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
AnalysisAI
Authenticated administrators of certain ASUS router models can abuse leftover debug code in the device's web management interface to enable the normally-disabled Telnet service via a crafted HTTP request, then execute arbitrary commands with root privileges on the router and potentially pivot to other devices on the same network. The flaw requires valid administrative credentials and a non-trivial request (vendor CVSS 4.0 8.9, AV:N/AC:H/PR:H), but once triggered it yields full root-level control with a scope change because the compromised router can be used to attack connected devices. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already be an authenticated administrator (PR:H) of the ASUS router's web management interface and to issue a specially crafted HTTP request that abuses leftover debug code to enable the normally-disabled Telnet service. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 score of 8.9 (High) reflects full compromise potential - root-level arbitrary command execution with a scope change (SC:H/SI:H/SA:H) because the compromised router can affect other connected devices. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status: patch available per vendor advisory - ASUS documents the fix under the 'Security Update for ASUS Router Firmware' section at https://www.asus.com/security-advisory, and the applicable firmware version must be taken from that advisory per model, since no exact fix version is included in the supplied data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all ASUS router models affected by CVE-2026-13313, disable WAN-side web management, restrict the web management interface to a trusted administrative VLAN or management network, enforce strong unique administrator credentials, enable MFA where supported, disable Telnet if present, and review logs for crafted HTTP requests or unexpected Telnet enablement. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote attackers can enable Telnet on TOTOLINK X5000R AX1800 routers running firmware V9.1.0u.6369_B2023
Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated
OS command injection in Netcore NAP930 firmware 0.1.241010.141410 allows unauthenticated remote attackers to execute arb
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers e
Missing authorization in Netcore NBR100V2 firmware 1.3.240614.030928 allows remote unauthenticated attackers to modify d
Authenticated administrators of ASUS routers can execute arbitrary commands on the device by uploading a crafted file th
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and ab
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can
A stack-based buffer overflow in the devdiscover service of FAST FAC1900R firmware 20190827_2.0.2 lets unauthenticated r
Unauthenticated OS command injection in the Netcore NBR200V2 router's Web Management Interface (firmware 1.3.241127.0712
Unauthenticated remote stack-based buffer overflow in the Netcore NR289-GE router (firmware 1.4.5102) lets an attacker c
Same weakness CWE-489 – Active Debug Code
View allShare
External POC / Exploit Code
Leaving vuln.today