CVE-2026-17518

An HTTP request smuggling vulnerability in the web application of multiple ASUS routers allows a remote unauthenticated attacker to cause a DoS by sending a specially crafted HTTP packet.

A vulnerability in the firmware of multiple ASUS routers allows bypassing CAPTCHA protection against brute-force attacks. An attacker can send a specific HTTP request to perform unlimited login attempts.

Improper authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations.

Improper neutralization of special elements used in an OS command (OS command injection) and cross-site request forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing website, causing the router to execute arbitrary commands with root privileges.

Improper neutralization of special elements used in an OS command in certain ASUS routers allows a remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.

Missing authentication for a critical function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests. The router returns device identification information and switches into a specific mode, which may prevent self-recovery under abnormal conditions.

An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby executing arbitrary commands with root privileges and potentially affecting other devices connected to the router.

A path traversal vulnerability has been identified in certain router models. A remote, authenticated attacker could exploit this vulnerability to write files outside the intended directory, potentially affecting device integrity.

An authentication bypass vulnerability has been identified in the IFTTT integration feature of ASUS routers. A remote, authenticated attacker could leverage this vulnerability to potentially gain unauthorized access to the device; this vulnerability does not affect Wi-Fi 7 series models.

A stack buffer overflow vulnerability has been identified in certain router models. An authenticated attacker may trigger this vulnerability by sending a crafted request, potentially impacting the availability of the device.