ASUS Router Buffer Overflow and Missing Auth

A stack-based buffer overflow in the web management interface of certain ASUS router models allows an attacker positioned on the adjacent network segment (LAN or Wi-Fi) who already holds high-privilege administrative credentials to corrupt device operations and cause a denial of service by sending an HTTP request containing an input field longer than the expected length. The 8.2 CVSS 4.0 score reflects high integrity and availability impact, but confidentiality is unaffected and the preconditions are substantial: no internet-facing exposure and no unauthenticated path, since the required admin session is already sufficient to reboot or reconfigure the device. No public exploit code or confirmed active exploitation was identified at time of analysis, and the advisory does not enumerate the specific affected models or firmware builds.

Certain ASUS router firmware exposes a critical function without authentication, allowing an attacker on the same adjacent network (LAN or Wi-Fi broadcast domain) to send crafted HTTP requests that disclose device identification information and force the router into a specific mode, potentially preventing self-recovery under abnormal conditions. The issue is medium severity (CVSS 5.3) because it requires adjacency and yields only low confidentiality, integrity, and availability impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and affected models/firmware versions are not enumerated in the available data.