---
id: CVE-2026-93489
title: >-
  Improper Authentication in ASUS router modules allows an unauthenticated
  nearby user to send an HTTP request and forge an access ticket, subsequently
  enabling the user to perform administrator operations.

  Refer to the ' Security Update f…
summary: >-
  Improper Authentication in ASUS router modules allows an unauthenticated
  nearby user to send an HTTP request and forge an access ticket, subsequently
  enabling the user to perform administrator operations.

  Refer to the ' Security Update f…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-287
vendor: ASUS
product: Router
affected:
  - Router 3.0.0.6_102 series
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-23T10:42:17.797223Z'
published: '2026-10-23'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T03:55:20.248Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-93489'
references:
  - url: 'https://www.asus.com/security-advisory'
tags:
  - cve.org
epss: 0.00189
epssPercentile: 0.08052
ingestedAt: '2026-10-23T08:19:41.044Z'
---

## Overview

Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations.
Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

## Affected

- `Router 3.0.0.6_102 series`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.