Command Injection Vulnerability in ASUS Router Firmware
CVE-2026-88710

8.7HIGH

Key Information:

Vendor

Asus
Status
Router Firmware
Vendor
CVE Published:
10 November 2026

What is CVE-2026-88710?

The vulnerability in ASUS Router firmware arises from improper neutralization of special elements in OS commands. This flaw allows an unauthenticated user within proximity to exploit the device, enabling unauthenticated queries, guessing identifiers, overwriting credentials, and injecting malicious commands. Such actions can result in arbitrary command execution with root privileges, posing significant security risks to the affected devices. Users are advised to consult the ASUS Security Advisory for detailed guidance on securing their devices.

Affected Version(s)

Router firmware 3.0.0.4.386 series

Router firmware 3.0.0.4.388 series

Router firmware 3.0.0.6.102 series

References

https://www.asus.com/security-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.