ASUS Router firmware: Cross-site scripting in web interface
Summary
Cross-site scripting (CWE-79) in the web interface modules of ASUS routers allows a remote attacker to read DOM information, modify router settings and cause a denial of service. The attack requires an authenticated user, typically an administrator, to visit a crafted URL. The CVSS 4.0 base score of 9.3 is based on the CNA (ASUS) data, as NVD analysis is still pending.
Affected
- ASUS Router, 3.0.0.6.102 series (per CVE record; other series are listed as unaffected by default)
- Exact affected models and firmware builds: Unknown.
Fixed in
- ASUS has released a firmware update on 7 October 2026 that covers this flaw.
- Fixed firmware versions per model: Unknown. Check the ASUS advisory and support page.
Workaround
- No CVE-specific workaround known.
- Do not open unknown links while logged into the router admin interface.
- Disable remote (WAN) administration as general hardening; this is not confirmed as a mitigation for this CVE.
Exploitation
- Not marked as known exploited (CISA ADP Vulnrichment).
- EPSS about 0.003 (Vulners).
- No public proof-of-concept found in our research; this does not prove none exists.
- Reported by Positive Technologies (PT-2026-107385).
Our recommendation
- Identify all ASUS routers and their firmware builds using the ASUS support page.
- Update to the latest firmware from the ASUS advisory and confirm the fixed build for each model with ASUS.
- Patch CVE-2026-19386 in the same update, as it was fixed in the same release.
- Restrict the admin interface to trusted LAN devices and disable WAN-side administration.
- Replace end-of-life models that will not receive fixes.
- Instruct staff not to click links while logged into router admin pages.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ASUS Security Advisory www.asus.com
- SNBForums: ASUS router security update (CVE-2026-14911) www.snbforums.com
- VulDB: CVE-2026-14911 vuldb.com
- CISA ADP Vulnrichment (via HOL Guard) hol.org
- Vulners Vulnrichment: CVE-2026-14911 vulners.com
- SecurityOnline: ASUS router firmware update securityonline.info
- SentinelOne: CVE-2026-19386 www.sentinelone.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:11.
Original description (NVD)
Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.