ASUS Router Firmware: Sensitive information written to log file
Summary
Certain ASUS router firmware series write DDNS credentials in plaintext to the system log. An authenticated remote attacker who can read the log can obtain these credentials and may use them to change the router's DNS settings. The attack requires valid login access to the router.
Affected
- ASUS router firmware series 3.0.0.4.386, 3.0.0.4.388 and 3.0.0.6.102 (per the CVE record; affected models not confirmed)
- Reporting conflicts on which series carry this CVE; confirm against the ASUS advisory
Fixed in
- Unknown. ASUS published firmware updates in October 2026 (3.0.0.4.386/3.0.0.4.388 series on 20 Oct, 3.0.0.6.102 series on 23 Oct), but no build number has been tied to CVE-2026-16528.
Workaround
- No vendor-confirmed workaround specific to this CVE.
- Disable DDNS and remote access from the WAN if not required.
- Use strong, unique administrator passwords.
Exploitation
- No known exploitation in the wild and no public proof-of-concept, according to ASUS.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- EPSS about 0.002.
Our recommendation
- Update the router firmware as part of the October 2026 update cycle and confirm the fixed build for your model on the ASUS advisory page.
- Prioritise routers with WAN-exposed administration or DDNS enabled.
- After patching, change the DDNS password, because the old credentials may remain in log history.
- Review the router's DNS settings for unexpected changes.
- Check whether the same devices are affected by other October 2026 ASUS vulnerabilities.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ASUS Security Advisory www.asus.com
- VulDB CVE-2026-16528 vuldb.com
- Vulners VulnRichment CVE-2026-16528 vulners.com
- SecurityOnline: ASUS router vulnerabilities and firmware update securityonline.info
- Overclock3D: ASUS issues WiFi router updates overclock3d.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:45.
Original description (NVD)
Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, potentially enabling modification of DNS settings.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.