---
id: "CVE-2026-75775"
kind: "vulnerability"
aliases: ["CVE-2026-75775"]
title: "ASUS routers: OS command injection lets remote user run root commands"
severity: "high"
cvss: 7.7
epss: 0.00477
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["asus", "infrastructure", "network-edge", "routers", "self-hosted"]
not_affected_if: ["configured-not-default", "patched-firmware"]
published_at: "2026-10-23T08:16:55+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:10:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75775", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-75775", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# ASUS routers: OS command injection lets remote user run root commands

Certain ASUS routers fail to neutralize special characters in parameters, so a remote user can inject OS commands. The commands run with root privileges on the router when it is in its factory-default state.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the router model and firmware version in the admin UI or with the vendor's app; compare against the affected list in the ASUS Security Advisory
- Confirm whether the router is still in factory-default configuration (default admin credentials not changed, setup not completed)

## Fix

- Update ASUS router firmware to the version listed as fixed in the ASUS Security Advisory (version unknown from the sources)
- Complete initial setup and change default credentials so the device is not in factory-default state

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-75775
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-75775

## From the sources

Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_