CVE-2026-13313
HighCVSS 8.9Summary
An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby executing arbitrary commands with root privileges and potentially affecting other devices connected to the router.
Risk Assessment
An attacker with a valid account can gain root privileges on the router and use it to launch further attacks against devices on the local network.
Recommendation
Apply the ASUS Router Firmware security update referenced in the ASUS advisory and disable the Telnet service if it is not required.
Other vulnerabilities in ASUS Router Firmware
See all- CVE-2021-41436High
An HTTP request smuggling vulnerability in the web application of multiple ASUS routers allows a remote unauthenticated attacker to cause a DoS by sending a specially crafted HTTP packet.
- CVE-2021-41435Critical
A vulnerability in the firmware of multiple ASUS routers allows bypassing CAPTCHA protection against brute-force attacks. An attacker can send a specific HTTP request to perform unlimited login attempts.
Original NVD description (English source)
An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby executing arbitrary commands with root privileges and potentially affecting other devices connected to the router. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS