ASUS vulnerabilities
190 CVEs and advisories name ASUS as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-88708An off-by-one error in certain ASUS Router firmware allows an unauthenticated nearby user to send a packet with a specific header length…
- CVE-2026-88707An out-of-bounds write in certain ASUS Router firmware allows an unauthenticated nearby user to send an HTTP request containing parameters…
- CVE-2026-88710Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an unauthenticated nearby user to…
- CVE-2026-88709Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an user with physical access to…
- CVE-2026-84729Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intended buffer or…
- CVE-2026-84730Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with…
- CVE-2026-112116An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write…
- CVE-2026-110464Missing authorization in ASUS Armoury Crate allows a local attacker to write content into a specific file or registry location with Local…
- CVE-2026-88781Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory…
- CVE-2026-75775Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands…
- CVE-2026-93489Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket…
- CVE-2026-75779Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an…
- CVE-2026-75753Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTT
- CVE-2026-17518Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations
- CVE-2026-102438An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges
- CVE-2026-14911Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read
- CVE-2026-19396A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an u
- CVE-2026-19386A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configu
- CVE-2026-16528Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credent
- CVE-2026-13313An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass s
- CVE-2026-14157Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via
- CVE-2026-93495Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a
- CVE-2026-19397Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the hos
- CVE-2026-12962A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by
- CVE-2026-18023Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive informatio
- CVE-2026-16003Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to add an arbitrary process identifier to the dri
- CVE-2026-16004Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read and write arbitrary PCI/PCIe configuratio
- CVE-2026-16005Release of Invalid Pointer or Reference in Armoury Crate driver allows a local user to free arbitrary memory via a crafted IOCTL request by
- CVE-2026-16006Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virt
- CVE-2026-75808Allocation of Resources Without Limits or Throttling in ASUS Armoury Crate allows a local user to cause a denial-of-service condition throug