Skip to content
OpenAdvisories
Medium · 6.0 Public exploit CVE-2026-12960 EUVD-2026-41482GHSA-6vqf-8qmc-rjr8

An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device t…

Published Jul 3, 2026 · Updated Sep 17, 2026 · Assigned by ASUS

Vendor: ASUS Product: Router app

Description

An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to send a crafted Intent that causes ASUS Router App to open an specified URL.
Refer to the '
Security Update for ASUS Router Android App ' section on the ASUS Security Advisory for more information.

Affected products

VendorProductAffectedFixed
ASUS Router app through 1.0.0.9.71 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • l0lsec/CVE-2026-12960 ★ 0 · Jul 25, 2026

    CVE-2026-12960 - Improper Export of Android Application Components in the ASUS Router app (com.asus.aihome). PoC, exploit APK, video, and vendor report. Fixed in 1.0.0.9.74.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References