ASUS Router firmware: Stack-based buffer overflow via configuration file upload
Summary
A stack-based buffer overflow in ASUS router firmware can be triggered by uploading a crafted configuration file that exceeds the expected buffer size. An authenticated attacker with access to the local or adjacent network could execute arbitrary code on the device. The CVSS v4.0 score is 9.3 (critical), but exploitation requires high privileges and network adjacency, so the flaw is not directly exposed to unauthenticated internet attackers.
Affected
- ASUS router firmware, 3.0.0.6.102 series (per CVE record)
- Exact models and build numbers: Unknown. ASUS has not published an itemized list in the sources reviewed.
- Whether the 3.0.0.4_386 and 3.0.0.4_388 branches are affected: Unknown.
Fixed in
- Unknown. A firmware update for the 3.0.0.6_102 branch was published, but the sources reviewed do not confirm that it fixes CVE-2026-19386.
Workaround
- No vendor-confirmed workaround was found.
- Restrict router administration to the LAN and disable remote management.
- Use a strong, unique administrator password.
Exploitation
- ASUS reports no known exploitation in the wild and no public proof-of-concept (secondary report).
- Not listed as known exploited in the CISA KEV catalogue in the sources reviewed.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Inventory ASUS routers and record exact models and firmware branches.
- For 3.0.0.6_102 devices, install the latest firmware for the exact model from the ASUS support page and confirm that the advisory lists CVE-2026-19386 as fixed.
- Replace devices on unsupported 3.0.0.4_386/388 branches where ASUS gives EOL guidance.
- Limit admin access to the LAN and enforce strong admin credentials.
- Monitor router logs for unexpected configuration file uploads.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ASUS Security Advisory www.asus.com
- SentinelOne CVE-2026-19386 www.sentinelone.com
- CVE-2026-19386 CVSS details (threatint) cve.threatint.com
- Vulners VulnRichment CVE-2026-19386 vulners.com
- Securityonline: ASUS router vulnerabilities and firmware update securityonline.info
- Strix AI CVE-2026-19386 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:12.
Original description (NVD)
A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.