RO
Product
Router
25
CVEs
0
On KEV
9.5
Max CVSS
11
New 30D
Severity mix
Critical 6High 13Medium 6Low 0
Watch
Add Router to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-13385 | 9.5 | Jul 15 | An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middle(MITM) user to make the router… Affected: 3.0.0.4_386 series; 3.0.0.4_388 series; 3.0.0.6_102 series |
| CVE-2026-14157 | 9.4 | Oct 1 | Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the… Affected: 3.0.0.6_102 series |
| CVE-2026-14911 | 9.3 | Oct 7 | Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router… Affected: 3.0.0.6.102 series |
| CVE-2026-19386 | 9.3 | Oct 7 | A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the… Affected: 3.0.0.6.102 series |
| CVE-2025-59366 | 9.2 | Nov 25 | An authentication-bypass vulnerability exists in AiCloud Affected: 3.0.0.4_386; 3.0.0.4_388; 3.0.0.6_102 |
| CVE-2025-2492 | 9.2 | Apr 18 | An improper authentication control vulnerability exists in AiCloud Affected: 3.0.0.4_382 series; 3.0.0.4_386 series; 3.0.0.4_388 series; 3.0.0.6_102 series |
| CVE-2026-13313 | 8.9 | Oct 1 | An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the… Affected: 3.0.0.4_386 series; 3.0.0.4_388 series; 3.0.0.6_102 series |
| CVE-2025-15101 | 8.8 | Mar 26 | An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrators to execute arbitrary system commands… Affected: 3.0.0.6_102 |
| CVE-2026-93489 New | 8.7 | Oct 23 | Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform… Affected: 3.0.0.6_102 series |
| CVE-2026-75779 New | 8.6 | Oct 23 | Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to trick… Affected: 3.0.0.6.102 series |
| CVE-2026-16528 | 8.4 | Oct 7 | Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, potentially… Affected: 3.0.0.4.386 series; 3.0.0.4.388 series; 3.0.0.6.102 series |
| CVE-2026-17518 | 8.2 | Oct 20 | Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an… Affected: ASUSWRT 3.0.0.4_386 series; ASUSWRT 3.0.0.4_388 series |
| CVE-2025-12003 | 8.2 | Nov 25 | A path traversal vulnerability has been identified in WebDAV, which may allow unauthenticated remote attackers to impact the integrity of the device Affected: 3.0.0.4_386; 3.0.0.4_388; 3.0.0.6_102 |
| CVE-2026-75775 New | 7.7 | Oct 23 | Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted… Affected: 3.0.0.6.102 series |
| CVE-2026-19396 | 7.7 | Oct 7 | A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user… Affected: 3.0.0.6_102 series |
| CVE-2025-59371 | 7.5 | Nov 25 | An authentication bypass vulnerability has been identified in the IFTTT integration feature Affected: 3.0.0.4_386; 3.0.0.4_388; 3.0.0.6_102 |
| CVE-2025-59370 | 7.5 | Nov 25 | A command injection vulnerability has been identified in bwdpi Affected: 3.0.0.4_386; 3.0.0.4_388; 3.0.0.6_102 |
| CVE-2024-13062 | 7.2 | Jan 2 | An unintended entry point vulnerability has been identified in certain router models, which may allow for arbitrary command execution Affected: 3.0.0.4_382 series; 3.0.0.4_386 series; 3.0.0.4_388 series; 3.0.0.6_102 series |
| CVE-2024-12912 | 7.2 | Jan 2 | An improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution Affected: 3.0.0.4_382 series; 3.0.0.4_386 series; 3.0.0.4_388 series; 3.0.0.6_102 series |
| CVE-2025-59372 | 6.9 | Nov 25 | A path traversal vulnerability has been identified in certain router models Affected: 3.0.0.4_386; 3.0.0.4_388; 3.0.0.6_102 |
| CVE-2025-59365 | 6.9 | Nov 25 | A stack buffer overflow vulnerability has been identified in certain router models Affected: 3.0.0.4_386; 3.0.0.4_388; 3.0.0.6_102 |
| CVE-2025-59368 | 6.0 | Nov 25 | An integer underflow vulnerability has been identified in Aicloud Affected: 3.0.0.4_386; 3.0.0.4_388; 3.0.0.6_102 |
| CVE-2026-11851 | 5.9 | Jul 15 | Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certain ASUS router models allows a remote authenticated… Affected: ASUSWRT 3.0.0.4_386 series; ASUSWRT 3.0.0.4_388 series; ASUSWRT 3.0.0.6_102 series |
| CVE-2025-59369 | 5.9 | Nov 25 | A SQL injection vulnerability has been identified in bwdpi Affected: 3.0.0.4_386; 3.0.0.4_388; 3.0.0.6_102 |
| CVE-2026-75753 | 5.3 | Oct 20 | Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to… Affected: 3.0.0.4.388 series |
Showing 25