ASUS RT-BE57 EUVD-2026-94158

Exploitation requires that the IFTTT integration feature be in use and that an administrator actively initiate an IFTTT pairing session while the attacker is present; the attacker must be within adjacent (wireless/radio) range of the ASUS RT-BE57 and able to observe the values emitted during that pairing exchange to reconstruct the token from the predictable PRNG seed. Limiting factors: adjacency is mandatory (not internet-reachable, AV:A), the attack is high-complexity (AC:H) and carries a present attack requirement (AT:P) because it depends on capturing a transient, admin-triggered pairing session - routers where IFTTT pairing is never used are not exploitable. No attacker authentication or victim click is required (PR:N/UI:N), but the dependence on a live pairing event makes exploitation opportunistic rather than on-demand.

The CVSS 4.0 base score of 7.7 (High) is driven by full high impact to confidentiality, integrity and availability of the router (VC:H/VI:H/VA:H), but tempered by significant exploitation barriers: adjacent-network vector (AV:A), high attack complexity (AC:H), and a present attack requirement (AT:P) - the attacker must observe a live administrator-initiated IFTTT pairing session to derive the predictable PRNG seed (CWE-337). PR:N/UI:N means no attacker privileges or victim interaction are needed, but the AT:P/AC:H combination means success hinges on an attacker being within wireless range at the exact moment an admin performs IFTTT pairing - a narrow, opportunistic window rather than a mass-exploitable condition. No EPSS score, KEV listing, or POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this reads as a credible but conditional, targeted-only risk rather than a widespread emergency. The signals are internally consistent (adjacency + session observation + no auth all align), so no contradictions require vendor verification, though the exact affected firmware versions are not enumerated in the input.

An attacker within wireless range of an ASUS RT-BE57 router passively observes the values exchanged during an administrator-initiated IFTTT pairing session. Because the pairing token is generated from a predictable PRNG seed, the attacker reconstructs the token from the observed values and then uses it to read and modify router settings. No public exploit code is identified at time of analysis, and success requires catching a pairing session in progress.