Vulnerabilities

Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an user with physical access to insert a USB…

Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an user with physical access to insert a USB device containing a specially crafted directory name, potentially executing arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

ASUS

Product

Router firmware

CVSS v4.0

7.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix

available

Weakness

CWE-78

Exposure class

Edge / VPN / firewall

NVD status

Received

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-88709 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 42
   CVE NVD 3h ago

   Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an unauthenticated nearby user to trigger a…

   CVSS 8.7 Fix available CVE-2026-88710 ASUS