Live › vulnerability › CVE-2026-75775
Go to dashboardCertain ASUS routers fail to neutralize special characters in parameters, so a remote user can inject OS commands. The commands run with root privileges on the router when it is in its factory-default state.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Owners of the listed ASUS router models that are still in factory-default state, where crafted parameters can reach the device. Routers that are fully configured and patched are not described as exposed by the sources. Managed or enterprise teams should inventory ASUS routers on their networks. The list of affected models is unknown from the sources.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
This page as .md · .json · in your agent: get_signal("CVE-2026-75775")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.