ASUS announced a new software version for router models using the 3.0.0.6_102 firmware series in a security advisory published on October 23. The update closes three separate security vulnerabilities. All three are in the high-risk group, and two can lead to command execution with root privileges on the device.
Records for the vulnerabilities were opened in the NVD on October 23. The records are still marked as “awaiting analysis,” and product matching (CPE) information has not been added yet. The vulnerabilities are not on CISA’s Known Exploited Vulnerabilities (KEV) list, so there is currently no confirmation that they are being exploited in the wild.
An attacker on the same network can gain admin privileges
The highest-scoring vulnerability is CVE-2026-93489, which scores 8.7 on the CVSS 4.0 scale. The issue stems from insufficient authentication checks in the router modules (CWE-287). An unauthenticated attacker on the same network can create an access ticket with a crafted HTTP request. With that ticket, it becomes possible to perform administrative operations on the router.
According to the wording in ASUS’s advisory, the attacker needs to be nearby; the scenario described is not direct access from the internet, but one that proceeds through a device that has already infiltrated the local network or a nearby wireless connection. Guest devices connecting to the home network, weakly password-protected guest networks, or compromised smart home devices shorten this path.
Root command on a factory-default device
The second vulnerability, CVE-2026-75775, is classified as OS command injection (CWE-78) and has a score of 7.7. Specially crafted parameters sent while the device is in factory settings allow command execution with root privileges on the router. Devices that have not completed setup and are left on the initial setup screen appear more exposed in this respect.
The third vulnerability, CVE-2026-75779, combines command injection with cross-site request forgery (CSRF) and carries an 8.6 score. The attacker lures an administrator who is logged into the router’s management panel to a fake site. When the visit occurs, the router executes the commands supplied by the attacker with root privileges. In this chain, the only user-side mistake is clicking a crafted link.
Patch and quick precautions
ASUS points to a firmware update as the primary solution. Owners of models in the 3.0.0.6_102 series should download and install the latest version from their product’s support page. Restarting the device after the update is recommended. Which models fall into this series can be checked from the firmware number on the model’s support page.
For those who cannot update immediately, ASUS lists four precautions. Use a strong and unique password of at least 10 characters, including uppercase letters, numbers, and symbols, for the management panel and wireless network; keep the management interface accessible only from a trusted local network and disable remote access on the WAN side; do not allow unknown devices to connect to the local network and wireless network; review and remove unknown paired devices and application sessions in the router settings.
Home routers are among the devices that can run for years without receiving updates. These three vulnerabilities once again show why regular firmware checks matter. If you see a new version on your model’s support page, don’t postpone the installation.
Source: NVD · ASUS Security Advisory
Share your experience
Bir sorunun, farklı bir çözümün veya eklemek istediğin bir notun var mı? Giriş yapmadan da yazabilirsin.