ASUS Router vulnerabilities

Use of an externally controlled format string in ASUS Router modules allows a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface.

An improper validation of integrity check value and improper certificate validation in certain ASUS router models allows a remote man-in-the-middle (MITM) attacker to force the router to download and execute arbitrary commands from a spoofed server.

An SQL Injection vulnerability in the web management interface of certain ASUS router models allows a remote authenticated user to disclose confidential information via a crafted request that bypasses existing input validation.