CVE-2026-14157
CriticalCVSS 9.4Summary
Use of an externally controlled format string in ASUS Router modules allows a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface.
Risk Assessment
An authenticated attacker can execute arbitrary commands on the router, potentially leading to full device and network compromise.
Recommendation
Update the router firmware to the latest version and restrict access to the management interface to trusted users only.
Other vulnerabilities in ASUS Router
See all- CVE-2026-13385Critical
An improper validation of integrity check value and improper certificate validation in certain ASUS router models allows a remote man-in-the-middle (MITM) attacker to force the router to download and execute arbitrary commands from a spoofed server.
- CVE-2026-11851Medium
An SQL Injection vulnerability in the web management interface of certain ASUS router models allows a remote authenticated user to disclose confidential information via a crafted request that bypasses existing input validation.
Original NVD description (English source)
Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS