ASUS Router: Format string vulnerability enables command execution
Summary
ASUS router firmware contains an externally controlled format string flaw (CWE-134) in the web management interface, where uploaded files are processed unsafely. An authenticated remote user with high privileges can execute arbitrary commands on the device, and the CVSS 4.0 score of 9.4 reflects full impact on confidentiality, integrity and availability. Press reports name the VPN client configuration import feature as the entry point, but this is not confirmed by the CVE record.
Affected
- ASUS Router, 3.0.0.6_102 series (per the official CVE record)
- Some media also list the 3.0.0.4_386 and 3.0.0.4_388 series; not confirmed by the vendor for this CVE
- Exact affected model list: Unknown.
Fixed in
Unknown. No confirmed fixed firmware build has been published for this CVE in the sources reviewed. Check the ASUS security advisory and the support page for your exact model.
Workaround
- Import VPN client configuration files only from trusted sources.
- Use a strong, unique admin password.
- Keep the management interface reachable only from trusted networks; disable WAN-side administration.
- Until a fix is confirmed, do not use the VPN import feature on devices that cannot be verified.
Exploitation
- Not confirmed in the wild. Neither the CVE record nor the router advisories state exploitation.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No public proof of concept found in the research; this does not prove none exists.
Our recommendation
- Inventory all ASUS routers and record model and exact firmware build.
- Apply the vendor firmware update once the fixed build for your model is confirmed; replace end-of-life devices that will not receive firmware.
- Until patched, disable WAN admin access, rotate admin passwords and stop importing VPN files from external sources.
- Review admin logs for unexpected VPN profile uploads or configuration changes.
- Check for the companion CVE-2026-13313 on the same firmware series.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ASUS Security Advisory www.asus.com
- CyberInsider: ASUS warns of critical router flaw triggered by malicious VPN files cyberinsider.com
- Cybernews: ASUS router VPN flaw hijack cybernews.com
- Tom's Hardware: Malicious VPN config files can let attackers run commands on ASUS routers www.tomshardware.com
- Lavx: ASUS patches critical router flaws news.lavx.hu
- OffSeq Radar: CVE-2026-14157 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:18.
Original description (NVD)
Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.