JVN#67560152
Command injection vulnerability in ASUS routers

Overview

A command injection vulnerability exists in ASUS routers.

Products Affected

ASUS routers with the AiCloud feature running with the following firmware series.

• 3.0.0.4_382 series
• 3.0.0.4_386 series
• 3.0.0.4_388 series
• 3.0.0.6_102 series

Description

Multiple routers provided by ASUSTeK COMPUTER INC. contain command injection vulnerability in AiCloud.

• Command injection (CWE-77)
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 9.3
  • CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 9.8
  • CVE-2025-2492

Impact

An arbitrary command could be executed on the affected products with the administrative privileges.

Solution

Update the Firmware
Update the firmware to the latest version according to the information provided by the developer.