CVE-2026-11851
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
An SQL Injection vulnerability in the web management interface of certain ASUS router models allows a remote authenticated user to disclose confidential information via a crafted request that bypasses existing input validation.
Risk Assessment
An attacker with administrative access could extract configuration data, passwords, or other sensitive information stored in the router's database.
Recommendation
Immediately update the ASUS router firmware to the latest version as recommended in the vendor's security advisory.
Other vulnerabilities in ASUS Router
See all- CVE-2026-14911Critical
Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.
- CVE-2026-19386Critical
A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.
- CVE-2026-14157Critical
Use of an externally controlled format string in ASUS Router modules allows a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface.
- CVE-2026-13385Critical
An improper validation of integrity check value and improper certificate validation in certain ASUS router models allows a remote man-in-the-middle (MITM) attacker to force the router to download and execute arbitrary commands from a spoofed server.
- CVE-2026-16528High
Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, potentially enabling modification of DNS settings.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certain ASUS router models allows a remote authenticated user to disclose confidential information via a crafted request that bypasses existing input validation Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS