ASUS Router firmware: Improper authentication allows administrator access

Summary

Improper authentication in ASUS router firmware of the 3.0.0.6_102 series allows an unauthenticated attacker on the adjacent network to send a crafted HTTP request and forge an access ticket. The forged ticket enables the attacker to perform administrator operations on the router. No login or user interaction is required, but the attacker must be on the local network, for example via a compromised laptop, a rogue device on guest Wi-Fi or a compromised IoT device. The CVSS 4.0 base score is 8.7 (High).

Affected

• ASUS Router firmware, 3.0.0.6_102 series (per the CVE record)
• ASUS has not published a complete list of affected models
• Default configuration: unaffected (per the CVE record)

Fixed in

• ASUS released a firmware update for the 3.0.0.6_102 series on 23 October 2026 (secondary reporting; sources differ on the publication date)
• Fixed build number: Unknown.
• The same update also addresses CVE-2026-75775 and CVE-2026-75779

Workaround

• If patching is not possible: disable remote access from WAN and limit management interface access to trusted local devices (reported ASUS guidance, not verified against the advisory text)
• Use distinct, strong passwords for the admin interface and Wi-Fi
• Restrict who can join the LAN and guest Wi-Fi
• Workarounds reduce exposure but do not replace the firmware update
• End-of-life models: Unknown whether a fix will be issued; treat them as unpatched

Exploitation

• Exploited in the wild: no evidence found
• CISA KEV: reported as not listed by a third-party tracker; not checked directly
• Public proof of concept: none found (VulDB states no exploit exists)
• CISA SSVC: exploitation none, not automatable, total technical impact
• Older ASUS router flaws have been abused in the wild

Our recommendation

• Update all affected ASUS routers of the 3.0.0.6_102 series to the current firmware from the ASUS security advisory
• Check the firmware version of every router in your environment, including the Wi-Fi 7 models
• Until patched, disable WAN management and restrict admin access to trusted devices
• Keep untrusted devices off the LAN and separate guest Wi-Fi
• Replace end-of-life models that will not receive a fix
• Monitor the router for unexpected admin logins or configuration changes

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  cybersecurity/CVE-2026-93489

Research sources

• ASUS Security Advisory www.asus.com
• CVE-2026-93489 record (threatint) cve.threatint.com
• VulDB CVE-2026-93489 vulnerability entry vuldb.com
• WindowsForum: firmware update fixes CVE-2026-93489 windowsforum.com
• TweakTown: firmware update for Wi-Fi 7 routers www.tweaktown.com
• TechPowerUp: ASUS rushes out Wi-Fi 7 router firmware update www.techpowerup.com
• RouterArena: ASUS patches Wi-Fi 7 router firmware routerarena.com
• CSO Online: ASUS patches critical router flaw www.csoonline.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:33.