ASUS Router Code Execution and Info Disclosure

A stack-based buffer overflow in ASUS router firmware modules lets an attacker who already holds administrative credentials on the device and is connected to the same local or Wi-Fi network segment execute arbitrary code by uploading a crafted configuration file that exceeds an expected buffer size. The flaw is rated CVSS 4.0 9.3 (Critical) and assessed as CVSS 3.1 AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, because successful exploitation yields full compromise of confidentiality, integrity and availability of the router, although the adjacent-network (AV:A) and high-privilege (PR:H) requirements exclude anonymous Internet-wide attack. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; vendor guidance is available through the ASUS Security Advisory.

Cross-site scripting in ASUS router web-management modules lets a remote, unauthenticated attacker read DOM information from the administrator's browser session, modify router settings, and drive the device into a denial-of-service condition when a logged-in administrator is induced to visit a crafted URL. The vendor assigns this CWE-79 flaw a CVSS 4.0 base score of 9.3 (Critical), and the weakness affects ASUS router firmware generally per the wildcard CPE, with no specific model or firmware versions enumerated in the available data. Successful exploitation still depends on social engineering and on a legitimate administrator being actively authenticated to the management interface at the time the link is opened; no public exploit code was identified at time of analysis and no EPSS score or CISA KEV listing is present in the source data.

Certain ASUS router models write DDNS (dynamic DNS) account credentials into the readable system log, so an attacker who already holds high-privilege administrative access and sits on the same or an adjacent network segment (LAN/Wi-Fi) can harvest those secrets from the log and potentially redirect DNS settings. The exposure is confirmed by the vendor (ASUS) and rated 8.4 High under CVSS 4.0, but the prerequisite of authenticated management access plus network adjacency makes it a context-dependent, moderate-priority issue rather than a mass-exploitable one; no public exploit code has been identified at time of analysis and no CISA KEV listing applies. The leak only yields credentials on devices where DDNS is actually configured and enabled.

Derivation of IFTTT pairing tokens in the ASUS RT-BE57 router allows an unauthenticated attacker within adjacent wireless range to read or modify router settings, provided they can observe a live administrator-initiated IFTTT pairing exchange. The root cause is a predictable seed in the pairing-token PRNG (CWE-337), which lets the attacker reconstruct the token from values emitted during that session; the assessed CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N, C:H/I:H/A:H) reflects full impact to router confidentiality, integrity, and availability but heavily conditioned on adjacency, high attack complexity, and a present attack requirement. Exploitation is therefore opportunistic rather than on-demand and only affects deployments where IFTTT integration is actually used; no public exploit code has been identified at time of analysis.