# cve.now: ASUS

The newest entries naming ASUS as an affected vendor (up to 200), of 190 in all, 2 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-88708](https://cve.now/CVE-2026-88708.md): An off-by-one error in certain ASUS Router firmware allows an unauthenticated nearby user to send a packet with a specific header length… (CVSS 5.3)
- [CVE-2026-88707](https://cve.now/CVE-2026-88707.md): An out-of-bounds write in certain ASUS Router firmware allows an unauthenticated nearby user to send an HTTP request containing parameters… (CVSS 7.1)
- [CVE-2026-88710](https://cve.now/CVE-2026-88710.md): Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an unauthenticated nearby user to… (CVSS 8.7)
- [CVE-2026-88709](https://cve.now/CVE-2026-88709.md): Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an user with physical access to… (CVSS 7.0)
- [CVE-2026-84729](https://cve.now/CVE-2026-84729.md): Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intended buffer or… (CVSS 7.2)
- [CVE-2026-84730](https://cve.now/CVE-2026-84730.md): Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with… (CVSS 8.7)
- [CVE-2026-112116](https://cve.now/CVE-2026-112116.md): An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write… (CVSS 8.5)
- [CVE-2026-110464](https://cve.now/CVE-2026-110464.md): Missing authorization in ASUS Armoury Crate allows a local attacker to write content into a specific file or registry location with Local… (CVSS 6.9)
- [CVE-2026-88781](https://cve.now/CVE-2026-88781.md): Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory… (CVSS 6.8)
- [CVE-2026-75775](https://cve.now/CVE-2026-75775.md): Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands… (CVSS 7.7)
- [CVE-2026-93489](https://cve.now/CVE-2026-93489.md): Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket… (CVSS 8.7)
- [CVE-2026-75779](https://cve.now/CVE-2026-75779.md): Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an… (CVSS 8.6)
- [CVE-2026-75753](https://cve.now/CVE-2026-75753.md): Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTT (CVSS 5.3)
- [CVE-2026-17518](https://cve.now/CVE-2026-17518.md): Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations (CVSS 8.2)
- [CVE-2026-102438](https://cve.now/CVE-2026-102438.md): An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges (CVSS 8.5)
- [CVE-2026-14911](https://cve.now/CVE-2026-14911.md): Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read (CVSS 9.3)
- [CVE-2026-19396](https://cve.now/CVE-2026-19396.md): A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an u (CVSS 7.7)
- [CVE-2026-19386](https://cve.now/CVE-2026-19386.md): A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configu (CVSS 9.3)
- [CVE-2026-16528](https://cve.now/CVE-2026-16528.md): Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credent (CVSS 8.4)
- [CVE-2026-13313](https://cve.now/CVE-2026-13313.md): An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass s (CVSS 8.9)
- [CVE-2026-14157](https://cve.now/CVE-2026-14157.md): Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via (CVSS 9.4)
- [CVE-2026-93495](https://cve.now/CVE-2026-93495.md): Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a (CVSS 7.0)
- [CVE-2026-19397](https://cve.now/CVE-2026-19397.md): Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the hos (CVSS 7.7)
- [CVE-2026-12962](https://cve.now/CVE-2026-12962.md): A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by (CVSS 5.3)
- [CVE-2026-18023](https://cve.now/CVE-2026-18023.md): Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive informatio (CVSS 5.7)
- [CVE-2026-16003](https://cve.now/CVE-2026-16003.md): Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to add an arbitrary process identifier to the dri (CVSS 2.0)
- [CVE-2026-16004](https://cve.now/CVE-2026-16004.md): Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read and write arbitrary PCI/PCIe configuratio (CVSS 5.9)
- [CVE-2026-16005](https://cve.now/CVE-2026-16005.md): Release of Invalid Pointer or Reference in Armoury Crate driver allows a local user to free arbitrary memory via a crafted IOCTL request by (CVSS 5.8)
- [CVE-2026-16006](https://cve.now/CVE-2026-16006.md): Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virt (CVSS 5.7)
- [CVE-2026-75808](https://cve.now/CVE-2026-75808.md): Allocation of Resources Without Limits or Throttling in ASUS Armoury Crate allows a local user to cause a denial-of-service condition throug (CVSS 5.7)
- [CVE-2026-75809](https://cve.now/CVE-2026-75809.md): Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to disclosure information and disabling device func (CVSS 5.9)
- [CVE-2026-75810](https://cve.now/CVE-2026-75810.md): Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user to cause a brief system stall by bypassing driver authenticati (CVSS 5.7)
- [CVE-2026-75811](https://cve.now/CVE-2026-75811.md): Improper Restriction of Software Interfaces to Hardware Features in ASUS Armoury Crate allows a local user to modify hardware configuration (CVSS 5.8)
- [CVE-2026-75754](https://cve.now/CVE-2026-75754.md): Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center a (CVSS 10.0)
- [CVE-2026-19398](https://cve.now/CVE-2026-19398.md): An out-of-bounds write in the SmiFlash SMM module of ASUS FA507NU and FA507NV BIOS allows a local administrator to cause a system crash (BS (CVSS 6.8)
- [CVE-2026-8917](https://cve.now/CVE-2026-8917.md): Untrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a local attacker to wr (CVSS 8.4)
- [CVE-2026-16727](https://cve.now/CVE-2026-16727.md): Concurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”) in ASUS Armoury Crate allows a local user to exe (CVSS 7.3)
- [CVE-2019-25764](https://cve.now/CVE-2019-25764.md): \*\*UNSUPPORTED WHEN ASSIGNED\*\* Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a local user to bypass the (CVSS 7.3)
- [CVE-2026-13385](https://cve.now/CVE-2026-13385.md): An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the (CVSS 9.5)
- [CVE-2026-15029](https://cve.now/CVE-2026-15029.md): Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local a (CVSS 8.4)
- [CVE-2026-15030](https://cve.now/CVE-2026-15030.md): Out-of-bounds Read in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrato (CVSS 5.6)
- [CVE-2026-13585](https://cve.now/CVE-2026-13585.md): Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Cont (CVSS 8.2)
- [CVE-2026-8920](https://cve.now/CVE-2026-8920.md): Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allo (CVSS 8.5)
- [CVE-2026-8919](https://cve.now/CVE-2026-8919.md): Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by co (CVSS 7.2)
- [CVE-2026-11851](https://cve.now/CVE-2026-11851.md): Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certain ASUS router (CVSS 5.9)
- [CVE-2022-4989](https://cve.now/CVE-2022-4989.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\* Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to acce (CVSS 8.5)
- [CVE-2022-4990](https://cve.now/CVE-2022-4990.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\* Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to bypa (CVSS 7.3)
- [CVE-2026-8921](https://cve.now/CVE-2026-8921.md): External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privi (CVSS 8.5)
- [CVE-2026-12960](https://cve.now/CVE-2026-12960.md): An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to (CVSS 6.0)
- [CVE-2026-8918](https://cve.now/CVE-2026-8918.md): A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform arbitrary memory read/write operations or (CVSS 7.1)
- [CVE-2026-7480](https://cve.now/CVE-2026-7480.md): An Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control Interface allows a local user to elevate privi (CVSS 7.3)
- [CVE-2026-8070](https://cve.now/CVE-2026-8070.md): Incorrect permission assignment for a critical resource in Armoury Crate allows a local user to bypass the driver’s validation mechanism, re (CVSS 7.3)
- [CVE-2026-3508](https://cve.now/CVE-2026-3508.md): An Out-of-bounds Read vulnerability in the IOCTL handler in ASUS System Control Interface allows a local user to cause system crash (BSOD) v (CVSS 6.8)
- [CVE-2026-6737](https://cve.now/CVE-2026-6737.md): An Exposed IOCTL with Insufficient Access Control vulnerability in AsusPTPFilter allows a local user to bypass driver security mechanisms an (CVSS 2.0)
- [CVE-2026-3428](https://cve.now/CVE-2026-3428.md): A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member Center(华硕大厅) allows a local user to achieve pr (CVSS 5.4)
- [CVE-2026-1880](https://cve.now/CVE-2026-1880.md): An Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverHub update process allows privilege escalation due (CVSS 5.4)
- [CVE-2025-15101](https://cve.now/CVE-2025-15101.md): An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrato (CVSS 8.6)
- [CVE-2025-15038](https://cve.now/CVE-2025-15038.md): An Out-of-Bounds Read vulnerability exists in the ASUS Business System Control Interface driver. (CVSS 6.9)
- [CVE-2026-1878](https://cve.now/CVE-2026-1878.md): An Insufficient Integrity Verification vulnerability in the ASUS ROG peripheral driver installation process allows privilege escalation to S (CVSS 5.4)
- [CVE-2025-15037](https://cve.now/CVE-2025-15037.md): An Incorrect Permission Assignment vulnerability exists in the ASUS Business System Control Interface driver. (CVSS 6.8)
- [CVE-2025-13348](https://cve.now/CVE-2025-13348.md): An improper access control vulnerability exists in ASUS Secure Delete Driver of ASUS Business Manager. (CVSS 8.5)
- [CVE-2025-12793](https://cve.now/CVE-2025-12793.md): An uncontrolled DLL loading path vulnerability exists in AsusSoftwareManagerAgent. (CVSS 8.5)
- [CVE-2025-59374](https://cve.now/CVE-2025-59374.md): "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced thro (CVSS 9.3, KEV)
- [CVE-2025-11775](https://cve.now/CVE-2025-11775.md): An out-of-bounds read vulnerability has been identified in the asComSvc service. (CVSS 4.8)
- [CVE-2025-11901](https://cve.now/CVE-2025-11901.md): An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using Intel B460, B560, B660, B760, H410, H510, H610, (CVSS 7.0)
- [CVE-2025-59372](https://cve.now/CVE-2025-59372.md): A path traversal vulnerability has been identified in certain router models. (CVSS 6.9)
- [CVE-2025-59371](https://cve.now/CVE-2025-59371.md): An authentication bypass vulnerability has been identified in the IFTTT integration feature. (CVSS 7.5)
- [CVE-2025-59370](https://cve.now/CVE-2025-59370.md): A command injection vulnerability has been identified in bwdpi. (CVSS 7.5)
- [CVE-2025-59369](https://cve.now/CVE-2025-59369.md): A SQL injection vulnerability has been identified in bwdpi. (CVSS 5.9)
- [CVE-2025-59368](https://cve.now/CVE-2025-59368.md): An integer underflow vulnerability has been identified in Aicloud. (CVSS 6.0)
- [CVE-2025-12003](https://cve.now/CVE-2025-12003.md): A path traversal vulnerability has been identified in WebDAV, which may allow unauthenticated remote attackers to impact the integrity of th (CVSS 8.2)
- [CVE-2025-59365](https://cve.now/CVE-2025-59365.md): A stack buffer overflow vulnerability has been identified in certain router models. (CVSS 6.9)
- [CVE-2025-59366](https://cve.now/CVE-2025-59366.md): An authentication-bypass vulnerability exists in AiCloud. (CVSS 9.2)
- [CVE-2025-59373](https://cve.now/CVE-2025-59373.md): A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. (CVSS 8.5)
- [CVE-2025-59367](https://cve.now/CVE-2025-59367.md): An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized ac (CVSS 9.3)
- [CVE-2025-9338](https://cve.now/CVE-2025-9338.md): A improper restriction of operations within the bounds of a memory buffer exists in AsIO3.sys driver. (CVSS 7.3)
- [CVE-2025-9337](https://cve.now/CVE-2025-9337.md): A null pointer dereference has been identified in the AsIO3.sys driver. (CVSS 6.8)
- [CVE-2025-9336](https://cve.now/CVE-2025-9336.md): A stack buffer overflow has been identified in the AsIO3.sys driver. (CVSS 6.8)
- [CVE-2025-9968](https://cve.now/CVE-2025-9968.md): A link following vulnerability exists in the UnifyScanner component of Armoury Crate. (CVSS 8.5)
- [CVE-2025-6398](https://cve.now/CVE-2025-6398.md): A null pointer dereference vulnerability exists in the IOMap64.sys driver of ASUS AI Suite 3. (CVSS 6.7)
- [CVE-2025-4570](https://cve.now/CVE-2025-4570.md): An insecure sensitive key storage issue was found in MyASUS. (CVSS 6.9)
- [CVE-2025-4569](https://cve.now/CVE-2025-4569.md): An insecure sensitive key storage issue was found in MyASUS. (CVSS 7.7)
- [CVE-2025-3464](https://cve.now/CVE-2025-3464.md): A race condition vulnerability exists in Armoury Crate. (CVSS 8.4)
- [CVE-2025-1533](https://cve.now/CVE-2025-1533.md): A stack buffer overflow has been identified in the AsIO3.sys driver. (CVSS 8.2)
- [CVE-2025-3463](https://cve.now/CVE-2025-3463.md): "This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulne (CVSS 9.4)
- [CVE-2025-3462](https://cve.now/CVE-2025-3462.md): "This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in AS (CVSS 8.4)
- [CVE-2025-2492](https://cve.now/CVE-2025-2492.md): An improper authentication control vulnerability exists in AiCloud. (CVSS 9.2)
- [CVE-2025-2027](https://cve.now/CVE-2025-2027.md): A double free vulnerability has been identified in the ASUS System Analysis service. (CVSS 5.9)
- [CVE-2025-1354](https://cve.now/CVE-2025-1354.md): A cross-site scripting (XSS) vulnerability in the RT-N10E/ RT-N12E 2.0.0.x firmware . (CVSS 4.8)
- [CVE-2024-12957](https://cve.now/CVE-2024-12957.md): A file handling command vulnerability in certain versions of Armoury Crate may result in arbitrary file deletion. (CVSS 8.4)
- [CVE-2024-55408](https://cve.now/CVE-2024-55408.md): An improper access control vulnerability in the AsusSAIO.sys driver may lead to the misuse of software functionality utilizing the driver wh (CVSS 5.1)
- [CVE-2024-13062](https://cve.now/CVE-2024-13062.md): An unintended entry point vulnerability has been identified in certain router models, which may allow for arbitrary command execution. (CVSS 7.2)
- [CVE-2024-12912](https://cve.now/CVE-2024-12912.md): An improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution. (CVSS 7.2)
- [CVE-2024-11985](https://cve.now/CVE-2024-11985.md): An improper input validation vulnerability leads to device crashes in certain ASUS router models. (CVSS 4.4)
- [CVE-2024-3912](https://cve.now/CVE-2024-3912.md): ASUS Router - Upload arbitrary firmware (CVSS 9.8)
- [CVE-2024-31163](https://cve.now/CVE-2024-31163.md): ASUS Download Master - Buffer Overflow (CVSS 7.2)
- [CVE-2024-31162](https://cve.now/CVE-2024-31162.md): ASUS Download Master - OS Command Injection (CVSS 7.2)
- [CVE-2024-31161](https://cve.now/CVE-2024-31161.md): ASUS Download Master - Arbitrary File Upload (CVSS 7.2)
- [CVE-2024-31160](https://cve.now/CVE-2024-31160.md): ASUS Download Master - Stored XSS (CVSS 4.8)
- [CVE-2024-31159](https://cve.now/CVE-2024-31159.md): ASUS Download Master - Reflected XSS (CVSS 4.8)
- [CVE-2024-3080](https://cve.now/CVE-2024-3080.md): ASUS Router - Improper Authentication (CVSS 9.8)
- [CVE-2024-3079](https://cve.now/CVE-2024-3079.md): ASUS Router - Stack-based Buffer Overflow (CVSS 7.2)
- [CVE-2024-0401](https://cve.now/CVE-2024-0401.md): ASUS OVPN RCE (CVSS 7.2)
- [CVE-2023-35720](https://cve.now/CVE-2023-35720.md): ASUS RT-AX92U lighttpd mod\_webdav.so SQL Injection Information Disclosure Vulnerability (CVSS 6.5)
- [CVE-2024-1655](https://cve.now/CVE-2024-1655.md): ASUS WiFi Router - OS Command Injection (CVSS 8.8)
- [CVE-2023-5716](https://cve.now/CVE-2023-5716.md): ASUS Armoury Crate - Arbitrary File Write (CVSS 9.8)
- [CVE-2023-41348](https://cve.now/CVE-2023-41348.md): ASUS RT-AX55 - command injection - 4 (CVSS 8.8)
- [CVE-2023-41347](https://cve.now/CVE-2023-41347.md): ASUS RT-AX55 - command injection - 3 (CVSS 8.8)
- [CVE-2023-41346](https://cve.now/CVE-2023-41346.md): ASUS RT-AX55 - command injection - 2 (CVSS 8.8)
- [CVE-2023-41345](https://cve.now/CVE-2023-41345.md): ASUS RT-AX55 - command injection - 1 (CVSS 8.8)
- [CVE-2023-41349](https://cve.now/CVE-2023-41349.md): ASUS RT-AX88U - externally-controlled format string (CVSS 8.8)
- [CVE-2023-39780](https://cve.now/CVE-2023-39780.md): On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start\_apply.htm… (CVSS 8.8, KEV)
- [CVE-2023-39240](https://cve.now/CVE-2023-39240.md): ASUS RT-AX55、RT-AX56U\_V2 - Format String - 3 (CVSS 7.2)
- [CVE-2023-39239](https://cve.now/CVE-2023-39239.md): ASUS RT-AX55、RT-AX56U\_V2、RT-AC86U - Format String - 2 (CVSS 7.2)
- [CVE-2023-39238](https://cve.now/CVE-2023-39238.md): ASUS RT-AX55、RT-AX56U\_V2 - Format String - 1 (CVSS 7.2)
- [CVE-2023-39237](https://cve.now/CVE-2023-39237.md): ASUS RT-AC86U - Command injection vulnerability - 5 (CVSS 8.8)
- [CVE-2023-39236](https://cve.now/CVE-2023-39236.md): ASUS RT-AC86U - Command injection vulnerability - 4 (CVSS 8.8)
- [CVE-2023-38033](https://cve.now/CVE-2023-38033.md): ASUS RT-AC86U - Command injection vulnerability - 3 (CVSS 8.8)
- [CVE-2023-38032](https://cve.now/CVE-2023-38032.md): ASUS RT-AC86U - Command injection vulnerability - 2 (CVSS 8.8)
- [CVE-2023-38031](https://cve.now/CVE-2023-38031.md): ASUS RT-AC86U - Command injection vulnerability - 1 (CVSS 8.8)
- [CVE-2023-34360](https://cve.now/CVE-2023-34360.md): ASUS RT-AX88U - Stored XSS (CVSS 8.2)
- [CVE-2023-34359](https://cve.now/CVE-2023-34359.md): ASUS RT-AX88U - Out-of-bounds Read - 2 (CVSS 7.5)
- [CVE-2023-34358](https://cve.now/CVE-2023-34358.md): ASUS RT-AX88U - Out-of-bounds Read - 1 (CVSS 7.5)
- [CVE-2023-35087](https://cve.now/CVE-2023-35087.md): ASUS RT-AX56U V2 & RT-AC86U - Format String - 2 (CVSS 9.8)
- [CVE-2023-35086](https://cve.now/CVE-2023-35086.md): ASUS RT-AX56U V2 & RT-AC86U - Format String -1 (CVSS 7.2)
- [CVE-2023-28703](https://cve.now/CVE-2023-28703.md): ASUS RT-AC86U - Buffer Overflow (CVSS 7.2)
- [CVE-2023-28702](https://cve.now/CVE-2023-28702.md): ASUS RT-AC86U - Command Injection (CVSS 8.8)
- [CVE-2022-35401](https://cve.now/CVE-2022-35401.md): An authentication bypass vulnerability exists in the get\_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386\_49674-ge182230. (CVSS 9.0)
- [CVE-2022-38105](https://cve.now/CVE-2022-38105.md): An information disclosure vulnerability exists in the cm\_processREQ\_NC opcode of Asus RT-AX82U 3.0.0.4.386\_49674-ge182230 router's configura (CVSS 7.5)
- [CVE-2022-38393](https://cve.now/CVE-2022-38393.md): A denial of service vulnerability exists in the cfg\_server cm\_processConnDiagPktList opcode of Asus RT-AX82U 3.0.0.4.386\_49674-ge182230 rout (CVSS 7.5)
- [CVE-2022-4221](https://cve.now/CVE-2022-4221.md): OS command injection in ASUS M25 NAS (CVSS 9.8)
- [CVE-2022-38699](https://cve.now/CVE-2022-38699.md): ASUS Armoury Crate Service - Arbitrary File Creation via Elevation of Privilege Flaw (CVSS 5.9)
- [CVE-2022-26669](https://cve.now/CVE-2022-26669.md): ASUS Control Center - SQL Injection (CVSS 8.8)
- [CVE-2022-26668](https://cve.now/CVE-2022-26668.md): ASUS Control Center - Broken Access Control (CVSS 7.3)
- [CVE-2022-26674](https://cve.now/CVE-2022-26674.md): ASUS RT-AX88U - Format String (CVSS 9.8)
- [CVE-2022-26673](https://cve.now/CVE-2022-26673.md): ASUS RT-AX88U - Stored XSS (CVSS 5.4)
- [CVE-2022-26672](https://cve.now/CVE-2022-26672.md): ASUS WebStorage - Use of Hard-coded Credentials (CVSS 7.3)
- [CVE-2022-25597](https://cve.now/CVE-2022-25597.md): ASUS RT-AC86U - Command Injection (CVSS 8.8)
- [CVE-2022-25596](https://cve.now/CVE-2022-25596.md): ASUS RT-AC86U - Heap-based buffer overflow (CVSS 8.8)
- [CVE-2022-25595](https://cve.now/CVE-2022-25595.md): ASUS RT-AC86U - Improper Input Validation (CVSS 6.5)
- [CVE-2022-23973](https://cve.now/CVE-2022-23973.md): ASUS RT-AX56U - Stack overflew (CVSS 8.8)
- [CVE-2022-23972](https://cve.now/CVE-2022-23972.md): ASUS RT-AX56U - SQL Injection (CVSS 8.8)
- [CVE-2022-23971](https://cve.now/CVE-2022-23971.md): ASUS RT-AX56U - Path Traversal (CVSS 8.1)
- [CVE-2022-23970](https://cve.now/CVE-2022-23970.md): ASUS RT-AX56U - Path Traversal (CVSS 8.1)
- [CVE-2022-22262](https://cve.now/CVE-2022-22262.md): ASUS Armoury Crate & Aura Creator Installer之ROG Live Service - Improper Link Resolution Before File Access (CVSS 7.7)
- [CVE-2022-21933](https://cve.now/CVE-2022-21933.md): ASUS VivoMini/Mini PC - improper input validation (CVSS 6.7)
- [CVE-2022-22054](https://cve.now/CVE-2022-22054.md): ASUS RT-AX56U - Path Traversal (CVSS 6.5)
- [CVE-2021-44158](https://cve.now/CVE-2021-44158.md): ASUS RT-AX56U Router - Stack-based buffer overflow (CVSS 8.0)
- [CVE-2021-41289](https://cve.now/CVE-2021-41289.md): ASUS P453UJ - Improper Restriction of Operations within the Bounds of a Memory Buffer (CVSS 6.3)
- [CVE-2021-37910](https://cve.now/CVE-2021-37910.md): ASUS GT-AXE11000, RT-AX3000, RT-AX55, RT-AX58U, TUF-AX3000 - Improper Authentication (CVSS 3.7)
- [CVE-2021-28209](https://cve.now/CVE-2021-28209.md): ASUS BMC's firmware: path traversal - Delete video file function (CVSS 4.9)
- [CVE-2021-28208](https://cve.now/CVE-2021-28208.md): ASUS BMC's firmware: path traversal - Get video file function (CVSS 4.9)
- [CVE-2021-28207](https://cve.now/CVE-2021-28207.md): ASUS BMC's firmware: path traversal - Get Help file function (CVSS 4.9)
- [CVE-2021-28206](https://cve.now/CVE-2021-28206.md): ASUS BMC's firmware: path traversal - Record video file function (CVSS 4.9)
- [CVE-2021-28205](https://cve.now/CVE-2021-28205.md): ASUS BMC's firmware: path traversal - Delete SOL video file function (CVSS 4.9)
- [CVE-2021-28204](https://cve.now/CVE-2021-28204.md): ASUS BMC's firmware: command injection - Modify user’s information function (CVSS 7.2)
- [CVE-2021-28203](https://cve.now/CVE-2021-28203.md): ASUS BMC's firmware: command injection - Web Set Media Image function (CVSS 7.2)
- [CVE-2021-28202](https://cve.now/CVE-2021-28202.md): ASUS BMC's firmware: buffer overflow - Service configuration-2 function (CVSS 4.9)
- [CVE-2021-28201](https://cve.now/CVE-2021-28201.md): ASUS BMC's firmware: buffer overflow - Service configuration-1 function (CVSS 4.9)
- [CVE-2021-28200](https://cve.now/CVE-2021-28200.md): ASUS BMC's firmware: buffer overflow - CD media configuration function (CVSS 4.9)
- [CVE-2021-28199](https://cve.now/CVE-2021-28199.md): ASUS BMC's firmware: buffer overflow - Modify user’s information function (CVSS 4.9)
- [CVE-2021-28198](https://cve.now/CVE-2021-28198.md): ASUS BMC's firmware: buffer overflow - Firmware protocol configuration (CVSS 4.9)
- [CVE-2021-28197](https://cve.now/CVE-2021-28197.md): ASUS BMC's firmware: buffer overflow - Active Directory configuration function (CVSS 4.9)
- [CVE-2021-28196](https://cve.now/CVE-2021-28196.md): ASUS BMC's firmware: buffer overflow - Generate SSL certificate function (CVSS 4.9)
- [CVE-2021-28195](https://cve.now/CVE-2021-28195.md): ASUS BMC's firmware: buffer overflow - Radius configuration function (CVSS 4.9)
- [CVE-2021-28194](https://cve.now/CVE-2021-28194.md): ASUS BMC's firmware: buffer overflow - Remote image configuration setting (CVSS 4.9)
- [CVE-2021-28193](https://cve.now/CVE-2021-28193.md): ASUS BMC's firmware: buffer overflow - SMTP configuration function (CVSS 4.9)
- [CVE-2021-28192](https://cve.now/CVE-2021-28192.md): ASUS BMC's firmware: buffer overflow - Remote video storage function (CVSS 4.9)
- [CVE-2021-28191](https://cve.now/CVE-2021-28191.md): ASUS BMC's firmware: buffer overflow - Firmware update function (CVSS 4.9)
- [CVE-2021-28190](https://cve.now/CVE-2021-28190.md): ASUS BMC's firmware: buffer overflow - Generate new certificate function (CVSS 4.9)
- [CVE-2021-28189](https://cve.now/CVE-2021-28189.md): ASUS BMC's firmware: buffer overflow - SMTP configuration function (CVSS 4.9)
- [CVE-2021-28188](https://cve.now/CVE-2021-28188.md): ASUS BMC's firmware: buffer overflow - Modify user’s information function (CVSS 4.9)
- [CVE-2021-28187](https://cve.now/CVE-2021-28187.md): ASUS BMC's firmware: buffer overflow - Generate new SSL certificate (CVSS 4.9)
- [CVE-2021-28186](https://cve.now/CVE-2021-28186.md): ASUS BMC's firmware: buffer overflow - ActiveX configuration-2 acquisition (CVSS 4.9)
- [CVE-2021-28185](https://cve.now/CVE-2021-28185.md): ASUS BMC's firmware: buffer overflow - ActiveX configuration-1 acquisition (CVSS 4.9)
- [CVE-2021-28184](https://cve.now/CVE-2021-28184.md): ASUS BMC's firmware: buffer overflow - Active Directory configuration function (CVSS 4.9)
- [CVE-2021-28183](https://cve.now/CVE-2021-28183.md): ASUS BMC's firmware: buffer overflow - Web License configuration setting (CVSS 4.9)
- [CVE-2021-28182](https://cve.now/CVE-2021-28182.md): ASUS BMC's firmware: buffer overflow - Web Service configuration function (CVSS 4.9)
- [CVE-2021-28181](https://cve.now/CVE-2021-28181.md): ASUS BMC's firmware: buffer overflow - Remote video configuration setting (CVSS 4.9)
- [CVE-2021-28180](https://cve.now/CVE-2021-28180.md): ASUS BMC's firmware: buffer overflow - Audit log configuration setting (CVSS 4.9)
- [CVE-2021-28179](https://cve.now/CVE-2021-28179.md): ASUS BMC's firmware: buffer overflow - Media support configuration setting (CVSS 4.9)
- [CVE-2021-28178](https://cve.now/CVE-2021-28178.md): ASUS BMC's firmware: buffer overflow - UEFI configuration function (CVSS 4.9)
- [CVE-2021-28177](https://cve.now/CVE-2021-28177.md): ASUS BMC's firmware: buffer overflow - LDAP configuration function (CVSS 4.9)
- [CVE-2021-28176](https://cve.now/CVE-2021-28176.md): ASUS BMC's firmware: buffer overflow - DNS configuration function (CVSS 4.9)
- [CVE-2021-28175](https://cve.now/CVE-2021-28175.md): ASUS BMC's firmware: buffer overflow - Radius configuration function (CVSS 4.9)
- [CVE-2019-11060](https://cve.now/CVE-2019-11060.md): HG100 contains an Uncontrolled Resource Consumption vulnerability (CVSS 7.4)
- [CVE-2019-11063](https://cve.now/CVE-2019-11063.md): SmartHome application has a broken access control vulnerability in its Web API Server (CVSS 10.0)
- [CVE-2019-11061](https://cve.now/CVE-2019-11061.md): HG100 has a broken access control vulnerability in its Web API Server (CVSS 10.0)
- [CVE-2016-6558](https://cve.now/CVE-2016-6558.md): The ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, is vulnerable to command injection (no CVSS)
- [CVE-2016-6557](https://cve.now/CVE-2016-6557.md): The ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, is vulnerable to cross-site request forgery (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/asus
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.