---
id: CVE-2026-75775
title: >-
  Improper Neutralization of Special Elements used in an OS Command in certain
  ASUS routers allows remote user to execute arbitrary commands with root
  privileges via crafted parameters sent to the router while the device is in
  its factory-…
summary: >-
  Improper Neutralization of Special Elements used in an OS Command in certain
  ASUS routers allows remote user to execute arbitrary commands with root
  privileges via crafted parameters sent to the router while the device is in
  its factory-…
severity: high
cvss: 7.7
cvssVector: 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-78
vendor: ASUS
product: Router
affected:
  - Router 3.0.0.6.102 series
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-23T10:42:04.786394Z'
published: '2026-10-23'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T03:55:18.582Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-75775'
references:
  - url: 'https://www.asus.com/security-advisory'
tags:
  - cve.org
epss: 0.00477
epssPercentile: 0.40223
ingestedAt: '2026-10-23T08:19:41.042Z'
---

## Overview

Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

## Affected

- `Router 3.0.0.6.102 series`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.