Cross-Site Scripting Vulnerability in ASUS Router Modules
CVE-2026-14911

9.3CRITICAL

Key Information:

Vendor

Asus
Status
Router
Vendor
CVE Published:
7 October 2026

What is CVE-2026-14911?

ASUS routers contain a vulnerability due to improper neutralization of input during web page generation, known as Cross-Site Scripting. This flaw allows a remote attacker to manipulate the DOM, modify the settings of the router, and potentially trigger a denial-of-service condition. The vulnerability is exploited when an authenticated user accesses a specially crafted URL. Users are encouraged to apply the latest firmware updates as detailed in the ASUS Security Advisory.

Affected Version(s)

Router 3.0.0.6.102 series

References

https://www.asus.com/security-advisory/

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.