Vulnerabilities

Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an unauthenticated nearby user to trigger a…

Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an unauthenticated nearby user to trigger a chain of actions—unauthenticated queries, identifier guessing, credential overwriting, and command injection—resulting in the execution of arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

ASUS

Product

Router firmware

CVSS v4.0

8.7 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix

available

Weakness

CWE-78

Exposure class

Edge / VPN / firewall

NVD status

Received

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-88710 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 42
   CVE NVD 3h ago

   Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an user with physical access to insert a USB…

   CVSS 7.0 Fix available CVE-2026-88709 ASUS