{"id":"CVE-2026-75775","kind":"vulnerability","aliases":["CVE-2026-75775"],"related":[],"title":"ASUS routers: OS command injection lets remote user run root commands","description":"Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.","summary":"Certain ASUS routers fail to neutralize special characters in parameters, so a remote user can inject OS commands. The commands run with root privileges on the router when it is in its factory-default state.","severity":"high","cvss":7.7,"epss":0.00477,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asus","infrastructure","network-edge","routers","self-hosted"],"not_affected_if":["configured-not-default","patched-firmware"],"how_to_check":"- Check the router model and firmware version in the admin UI or with the vendor's app; compare against the affected list in the ASUS Security Advisory\n- Confirm whether the router is still in factory-default configuration (default admin credentials not changed, setup not completed)","fix":"- Update ASUS router firmware to the version listed as fixed in the ASUS Security Advisory (version unknown from the sources)\n- Complete initial setup and change default credentials so the device is not in factory-default state","status":"open","published_at":"2026-10-23T08:16:55+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:10:24+00:00","updated_at":"2026-10-25T03:10:24+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:10:24Z","model":"claude-haiku-5-5","output":{"fix":"- Update ASUS router firmware to the version listed as fixed in the ASUS Security Advisory (version unknown from the sources)\n- Complete initial setup and change default credentials so the device is not in factory-default state","reach":"network","title":"ASUS routers: OS command injection lets remote user run root commands","impact":"high","summary":"Certain ASUS routers fail to neutralize special characters in parameters, so a remote user can inject OS commands. The commands run with root privileges on the router when it is in its factory-default state.","category":"infrastructure","nicknames":[],"who_cares":["asus","routers","self-hosted","network-edge"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker runs arbitrary commands as root on the router","analyst_note":"Find the affected ASUS model list and fixed firmware versions in the ASUS Security Advisory linked from the NVD entry.","how_to_check":"- Check the router model and firmware version in the admin UI or with the vendor's app; compare against the affected list in the ASUS Security Advisory\n- Confirm whether the router is still in factory-default configuration (default admin credentials not changed, setup not completed)","needs_analyst":true,"not_affected_if":["patched-firmware","configured-not-default"],"who_is_affected":"Owners of the listed ASUS router models that are still in factory-default state, where crafted parameters can reach the device. Routers that are fully configured and patched are not described as exposed by the sources. Managed or enterprise teams should inventory ASUS routers on their networks. The list of affected models is unknown from the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000629,"input_tokens":3371,"output_tokens":584,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-75775':14A,17A 'advisori':117C 'allow':77C 'arbitrari':82C 'asus':1A,18B,28B,75C,109C,115C 'certain':27B,74C 'charact':34B 'command':4A,11A,44B,46B,72C,83C 'craft':88C 'cve':12A,15A 'default':61B,102C 'devic':96C 'edg':22B 'element':67C 'execut':81C 'factori':60B,101C 'factory-default':59B,100C 'fail':30B 'firmwar':111C 'host':26B 'improp':63C 'inform':120C 'infrastructur':19B 'inject':5A,42B 'let':6A 'network':21B 'network-edg':20B 'neutral':32B,64C 'os':3A,43B,71C 'paramet':36B,89C 'privileg':50B,86C 'remot':7A,39B,78C 'root':10A,49B,85C 'router':2A,23B,29B,53B,76C,93C,110C 'run':9A,47B 'section':112C 'secur':106C,116C 'self':25B 'self-host':24B 'sent':90C 'special':33B,66C 'state':62B 'state.refer':103C 'updat':107C 'use':68C 'user':8A,40B,79C 'via':87C","nicknames":[],"mitigations":[],"who_affected":"Owners of the listed ASUS router models that are still in factory-default state, where crafted parameters can reach the device. Routers that are fully configured and patched are not described as exposed by the sources. Managed or enterprise teams should inventory ASUS routers on their networks. The list of affected models is unknown from the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T08:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-75775","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75775","severity":null,"published_at":"2026-10-23T08:16:55+00:00","modified_at":"2026-10-23T19:42:24+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-75775","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75775","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}