CVE-2026-13385
CriticalCVSS 9.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
An improper validation of integrity check value and improper certificate validation in certain ASUS router models allows a remote man-in-the-middle (MITM) attacker to force the router to download and execute arbitrary commands from a spoofed server.
Risk Assessment
An attacker could take full control of the router, alter its configuration, intercept network traffic, or install malware, posing a critical threat to the entire local network's security.
Recommendation
Immediately update the ASUS router firmware to the latest version provided in the official ASUS security advisory. As a temporary measure, restrict administrative access to the router's web interface to trusted networks only.
Other vulnerabilities in ASUS Router
See all- CVE-2026-14911Critical
Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.
- CVE-2026-19386Critical
A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.
- CVE-2026-14157Critical
Use of an externally controlled format string in ASUS Router modules allows a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface.
- CVE-2026-16528High
Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, potentially enabling modification of DNS settings.
- CVE-2026-11851Medium
An SQL Injection vulnerability in the web management interface of certain ASUS router models allows a remote authenticated user to disclose confidential information via a crafted request that bypasses existing input validation.
Original NVD description (English source)
An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middle(MITM) user to make the router download and execute arbitrary command via a spoofed server. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS