CVE-2026-13385
CriticalCVSS 9.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
An improper validation of integrity check value and improper certificate validation in certain ASUS router models allows a remote man-in-the-middle (MITM) attacker to force the router to download and execute arbitrary commands from a spoofed server.
Risk Assessment
An attacker could take full control of the router, alter its configuration, intercept network traffic, or install malware, posing a critical threat to the entire local network's security.
Recommendation
Immediately update the ASUS router firmware to the latest version provided in the official ASUS security advisory. As a temporary measure, restrict administrative access to the router's web interface to trusted networks only.
Original NVD description (English source)
An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middle(MITM) user to make the router download and execute arbitrary command via a spoofed server. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.