CVE-2026-93489

An HTTP request smuggling vulnerability in the web application of multiple ASUS routers allows a remote unauthenticated attacker to cause a DoS by sending a specially crafted HTTP packet.

A vulnerability in the firmware of multiple ASUS routers allows bypassing CAPTCHA protection against brute-force attacks. An attacker can send a specific HTTP request to perform unlimited login attempts.

Improper neutralization of special elements used in an OS command (OS command injection) and cross-site request forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing website, causing the router to execute arbitrary commands with root privileges.

Improper neutralization of special elements used in an OS command in certain ASUS routers allows a remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.

Missing authentication for a critical function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests. The router returns device identification information and switches into a specific mode, which may prevent self-recovery under abnormal conditions.

Certain ASUS router models contain a buffer copy without checking input size. An adjacent authenticated user can corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length.

An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby executing arbitrary commands with root privileges and potentially affecting other devices connected to the router.

A path traversal vulnerability has been identified in certain router models. A remote, authenticated attacker could exploit this vulnerability to write files outside the intended directory, potentially affecting device integrity.

An authentication bypass vulnerability has been identified in the IFTTT integration feature of ASUS routers. A remote, authenticated attacker could leverage this vulnerability to potentially gain unauthorized access to the device; this vulnerability does not affect Wi-Fi 7 series models.

A stack buffer overflow vulnerability has been identified in certain router models. An authenticated attacker may trigger this vulnerability by sending a crafted request, potentially impacting the availability of the device.