CVE-2026-11851

MediumCVSS 5.9

Published: 15/07/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

23th percentile - higher than 23% of all known CVEs

Summary

An SQL Injection vulnerability in the web management interface of certain ASUS router models allows a remote authenticated user to disclose confidential information via a crafted request that bypasses existing input validation.

Risk Assessment

An attacker with administrative access could extract configuration data, passwords, or other sensitive information stored in the router's database.

Recommendation

Immediately update the ASUS router firmware to the latest version as recommended in the vendor's security advisory.

Other vulnerabilities in ASUS Router

CVE-2026-13385Critical
An improper validation of integrity check value and improper certificate validation in certain ASUS router models allows a remote man-in-the-middle (MITM) attacker to force the router to download and execute arbitrary commands from a spoofed server.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certain ASUS router models allows a remote authenticated user to disclose confidential information via a crafted request that bypasses existing input validation Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.