CVE-2025-59372
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A path traversal vulnerability has been identified in certain router models. A remote, authenticated attacker could exploit this vulnerability to write files outside the intended directory, potentially affecting device integrity.
Risk Assessment
An attacker may write files to unintended locations, potentially compromising device integrity and leading to takeover.
Recommendation
Apply the ASUS router firmware security update as described in the vendor's security advisory.
Other vulnerabilities in ASUS Router Firmware
See all- CVE-2021-41436High
An HTTP request smuggling vulnerability in the web application of multiple ASUS routers allows a remote unauthenticated attacker to cause a DoS by sending a specially crafted HTTP packet.
- CVE-2021-41435Critical
A vulnerability in the firmware of multiple ASUS routers allows bypassing CAPTCHA protection against brute-force attacks. An attacker can send a specific HTTP request to perform unlimited login attempts.
- CVE-2026-93489High
Improper authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations.
- CVE-2026-75779High
Improper neutralization of special elements used in an OS command (OS command injection) and cross-site request forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing website, causing the router to execute arbitrary commands with root privileges.
- CVE-2026-75775High
Improper neutralization of special elements used in an OS command in certain ASUS routers allows a remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.
- CVE-2026-75753Medium
Missing authentication for a critical function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests. The router returns device identification information and switches into a specific mode, which may prevent self-recovery under abnormal conditions.
- CVE-2026-17518High
Certain ASUS router models contain a buffer copy without checking input size. An adjacent authenticated user can corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length.
- CVE-2026-13313High
An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby executing arbitrary commands with root privileges and potentially affecting other devices connected to the router.
- CVE-2025-59371High
An authentication bypass vulnerability has been identified in the IFTTT integration feature of ASUS routers. A remote, authenticated attacker could leverage this vulnerability to potentially gain unauthorized access to the device; this vulnerability does not affect Wi-Fi 7 series models.
- CVE-2025-59365Medium
A stack buffer overflow vulnerability has been identified in certain router models. An authenticated attacker may trigger this vulnerability by sending a crafted request, potentially impacting the availability of the device.
Original NVD description (English source)
A path traversal vulnerability has been identified in certain router models. A remote, authenticated attacker could exploit this vulnerability to write files outside the intended directory, potentially affecting device integrity. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS