Vendor
ASUS
190 known vulnerabilities.
Products
88 results · Clear filters · Feed
-
High 8.4CVE-2025-3464 Public exploit
A race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issu…
-
High 8.2
A stack buffer overflow has been identified in the AsIO3.sys driver. This vulnerability can be triggered by input manip…
-
High 8.4
"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insuffic…
-
High 8.4
A file handling command vulnerability in certain versions of Armoury Crate may result in arbitrary file deletion. Refer…
-
High 7.2
An unintended entry point vulnerability has been identified in certain router models, which may allow for arbitrary com…
-
High 7.2CVE-2024-12912 Public exploit
An improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution. …
-
High 7.2
ASUS Download Master - Buffer Overflow
ASUS Download Master has a buffer overflow vulnerability. An unauthenticated remote attacker with administrative privileges can exploit this vulnerability to execute arbitrary system commands on the device.
-
High 7.2
ASUS Download Master - OS Command Injection
The specific function parameter of ASUS Download Master does not properly filter user input. An unauthenticated remote attacker with administrative privileges can exploit this vulnerability to execute arbitrary system commands on the device.
-
High 7.2
ASUS Download Master - Arbitrary File Upload
The upload functionality of ASUS Download Master does not properly filter user input. Remote attackers with administrative privilege can exploit this vulnerability to upload any file to any location. They may even upload malicious web page files to the websit…
-
High 7.2
ASUS Router - Stack-based Buffer Overflow
Certain models of ASUS routers have buffer overflow vulnerabilities, allowing remote attackers with administrative privileges to execute arbitrary commands on the device.
-
High 7.2
ASUS OVPN RCE
ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS Exp…
-
High 8.8CVE-2024-1655 Public exploit
ASUS WiFi Router - OS Command Injection
Certain ASUS WiFi routers models has an OS Command Injection vulnerability, allowing an authenticated remote attacker to execute arbitrary system commands by sending a specially crafted request.
-
High 8.8CVE-2023-41348 Public exploit
ASUS RT-AX55 - command injection - 4
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its code-authentication module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to …
-
High 8.8
ASUS RT-AX55 - command injection - 3
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its check token module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute …
-
High 8.8CVE-2023-41346 Public exploit
ASUS RT-AX55 - command injection - 2
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execut…
-
High 8.8
ASUS RT-AX55 - command injection - 1
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to exec…
-
High 8.8
ASUS RT-AX88U - externally-controlled format string
ASUS router RT-AX88U has a vulnerability of using externally controllable format strings within its Advanced Open VPN function. An authenticated remote attacker can exploit the exported OpenVPN configuration to execute an externally-controlled format string a…
-
High 8.8
On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_appl…
KEV Jun 2, 2025 -
High 7.2
ASUS RT-AX55、RT-AX56U_V2 - Format String - 3
It is identified a format string vulnerability in ASUS RT-AX56U V2’s iperf client function API. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_cli.cgi module. A remote attacker with administrator privilege can ex…
-
High 7.2
ASUS RT-AX55、RT-AX56U_V2、RT-AC86U - Format String - 2
It is identified a format string vulnerability in ASUS RT-AX56U V2’s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. A remote attacker with administrator privilege can exploit this vul…
-
High 7.2
ASUS RT-AX55、RT-AX56U_V2 - Format String - 1
It is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_svr.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to …
-
High 8.8
ASUS RT-AC86U - Command injection vulnerability - 5
ASUS RT-AC86U Traffic Analyzer - Apps analysis function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt sy…
-
High 8.8
ASUS RT-AC86U - Command injection vulnerability - 4
ASUS RT-AC86U Traffic Analyzer - Statistic function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system…
-
High 8.8
ASUS RT-AC86U - Command injection vulnerability - 3
ASUS RT-AC86U unused Traffic Analyzer legacy Statistic function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, di…
-
High 8.8
ASUS RT-AC86U - Command injection vulnerability - 2
ASUS RT-AC86U AiProtection security- related function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt syst…
-
High 8.8
ASUS RT-AC86U - Command injection vulnerability - 1
ASUS RT-AC86U Adaptive QoS - Web History function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system o…
-
High 8.2
ASUS RT-AX88U - Stored XSS
A stored cross-site scripting (XSS) issue was discovered within the Custom User Icons functionality of ASUS RT-AX88U running firmware versions 3.0.0.4.388.23110 and prior. After a remote attacker logging in device with regular user privilege, the remote atta…
-
High 7.5
ASUS RT-AX88U - Out-of-bounds Read - 2
ASUS RT-AX88U's httpd is subject to an unauthenticated DoS condition. A remote attacker can send a specially crafted request to the device which causes the httpd binary to crash within the "do_json_decode()" function of ej.c, resulting in a DoS condition.
-
High 7.5
ASUS RT-AX88U - Out-of-bounds Read - 1
ASUS RT-AX88U's httpd is subject to an unauthenticated DoS condition. A remote attacker can send a specially crafted request to a device which contains a specific user agent, causing the httpd binary to crash during a string comparison performed within web.c,…
-
High 7.2
ASUS RT-AX56U V2 & RT-AC86U - Format String -1
It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by directly using input as a format string when calling syslog in logmessage_normal function, in the do_detwan_cgi module of httpd. A remote attacker w…
-
High 7.2
ASUS RT-AC86U - Buffer Overflow
ASUS RT-AC86U’s specific cgi function has a stack-based buffer overflow vulnerability due to insufficient validation for network packet header length. A remote attacker with administrator privileges can exploit this vulnerability to execute arbitrary system c…
-
High 8.8
ASUS RT-AC86U - Command Injection
ASUS RT-AC86U does not filter special characters for parameters in specific web URLs. A remote attacker with normal user privileges can exploit this vulnerability to perform command injection attack to execute arbitrary system commands, disrupt system or term…
-
High 7.5
An information disclosure vulnerability exists in the cm_processREQ_NC opcode of Asus RT-AX82U 3.0.0.4.386_49674-ge1822…
-
High 7.5CVE-2022-38393 EPSS 19%
A denial of service vulnerability exists in the cfg_server cm_processConnDiagPktList opcode of Asus RT-AX82U 3.0.0.4.38…
-
High 8.8
ASUS Control Center - SQL Injection
ASUS Control Center is vulnerable to SQL injection. An authenticated remote attacker with general user privilege can inject SQL command to specific API parameters to acquire database schema or access data.
-
High 7.3
ASUS Control Center - Broken Access Control
ASUS Control Center API has a broken access control vulnerability. An unauthenticated remote attacker can call privileged API functions to perform partial system operations or cause partial disrupt of service.
-
High 7.3
ASUS WebStorage - Use of Hard-coded Credentials
ASUS WebStorage has a hardcoded API Token in the APP source code. An unauthenticated remote attacker can use this token to establish connections with the server and carry out login attempts to general user accounts. A successful login to a general user accoun…
-
High 8.8
ASUS RT-AC86U - Command Injection
ASUS RT-AC86U’s LPD service has insufficient filtering for special characters in the user request, which allows an unauthenticated LAN attacker to perform command injection attack, execute arbitrary commands and disrupt or terminate service.
-
High 8.8
ASUS RT-AC86U - Heap-based buffer overflow
ASUS RT-AC56U’s configuration function has a heap-based buffer overflow vulnerability due to insufficient validation for the decryption parameter length, which allows an unauthenticated LAN attacker to execute arbitrary code, perform arbitrary operations and …
-
High 8.8
ASUS RT-AX56U - Stack overflew
ASUS RT-AX56U’s user profile configuration function is vulnerable to stack-based buffer overflow due to insufficient validation for parameter length. An unauthenticated LAN attacker can execute arbitrary code to perform arbitrary operations or disrupt service.