CVE-2026-75753Medium· 5.3▾ SunlitMissing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to return device identification information and switch into a spec…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to return device identification information and switch into a specific mode. As a result, when the router encounters abnormal conditions, it may be unable to perform self-recovery. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
Router 3.0.0.4.388 seriesRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-17518High· 8.2Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length. Refer…
CVE-2026-19396High· 7.7A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and read or modify router settings via obs…
CVE-2026-16528High· 8.4Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, potentially enabling modification of DNS settings.Refer to the ' Securi…
CVE-2026-19386Critical· 9.3A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security Update for ASUS …
CVE-2026-13313High· 8.9An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby executing arbitrary commands with root …
CVE-2026-14157Critical· 9.4Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface.