{"id":"CVE-2026-88707","kind":"vulnerability","aliases":["CVE-2026-88707"],"related":[],"title":"ASUS Router firmware: oversized HTTP parameters overwrite memory, crash device","description":"An\nout-of-bounds write in certain ASUS Router firmware\nallows an unauthenticated nearby user to send an HTTP request containing\nparameters that exceed the buffer length, potentially overwriting other memory\nregions or causing the system to crash.\nRefer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.","summary":"Certain ASUS router firmware has an out-of-bounds write triggered by an HTTP request with parameters longer than a buffer. An unauthenticated nearby attacker could overwrite other memory or crash the router.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asus","firmware","home-network","infrastructure","routers"],"not_affected_if":["no-local-network-access","unaffected-firmware"],"how_to_check":"- Find your router model and firmware version in the admin page (Administration > Firmware Upgrade), then compare with the 'Security Update for ASUS Router Firmware' entry on https://www.asus.com/security-advisory. The ASUS entry was not readable by us, so affected models and the fixed build are unknown. Also check ASUS's support page for your model for a firmware build newer than your current one.","fix":null,"status":"open","published_at":"2026-11-10T02:16:45+00:00","first_seen_at":"2026-11-10T02:49:23+00:00","triaged_at":"2026-11-10T02:50:07+00:00","updated_at":"2026-11-10T02:51:42+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T02:50:07Z","model":"claude-haiku-5-5","output":{"fix":"- Install the ASUS Router firmware update named in the 'Security Update for ASUS Router Firmware' section of the ASUS Security Advisory\n- Exact fixed version: unknown","reach":"network","title":"ASUS Router firmware: oversized HTTP parameters overwrite memory, crash device","impact":"medium","summary":"Certain ASUS router firmware has an out-of-bounds write triggered by an HTTP request with parameters longer than a buffer. An unauthenticated nearby attacker could overwrite other memory or crash the router.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["asus","routers","home-network","firmware"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker crashes router or overwrites its memory","analyst_note":"Pull the ASUS Security Advisory and NVD page to confirm affected models, firmware versions and the fixed build for CVE-2026-88707.","how_to_check":"- Check the firmware version on the router's admin page against the ASUS Security Advisory for this CVE\n- unknown for exact affected model and version ranges, as the sources do not list them","plain_action":"Update your ASUS router's firmware to the latest version from ASUS.","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-firmware","no-local-network-access"],"who_is_affected":"Owners of certain ASUS router models running affected firmware are exposed. The attack needs a nearby user who can send HTTP requests to the device, which is a local-network position rather than the internet. Routers with no vulnerable firmware, or with the admin interface unreachable from the local network, are less exposed; the sources do not list the exact models.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000773,"input_tokens":4582,"output_tokens":629,"severity_before":"high"},"analyst_status":"done","analyst_note":"Pull the ASUS Security Advisory and NVD page to confirm affected models, firmware versions and the fixed build for CVE-2026-88707.","search":"'-2026':12A,15A '-88707':13A,16A 'advisori':111C 'allow':69C 'asus':1A,17B,25B,66C,103C,109C 'attack':49B 'bound':33B,62C 'buffer':45B,84C 'caus':92C 'certain':24B,65C 'contain':79C 'could':50B 'crash':9A,55B,96C 'cve':11A,14A 'devic':10A 'exceed':82C 'firmwar':3A,18B,27B,68C,105C 'home':20B 'home-network':19B 'http':5A,38B,77C 'inform':114C 'infrastructur':22B 'length':85C 'longer':42B 'memori':8A,53B,89C 'nearbi':48B,72C 'network':21B 'out-of-bound':30B,59C 'overs':4A 'overwrit':7A,51B,87C 'paramet':6A,41B,80C 'potenti':86C 'refer':97C 'region':90C 'request':39B,78C 'router':2A,23B,26B,57B,67C,104C 'section':106C 'secur':100C,110C 'send':75C 'system':94C 'trigger':35B 'unauthent':47B,71C 'updat':101C 'user':73C 'write':34B,63C","nicknames":[],"mitigations":[],"who_affected":"Owners of certain ASUS router models running affected firmware are exposed. The attack needs a nearby user who can send HTTP requests to the device, which is a local-network position rather than the internet. Routers with no vulnerable firmware, or with the admin interface unreachable from the local network, are less exposed; the sources do not list the exact models.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"Update your ASUS router's firmware to the latest version from ASUS.","pkeys":[],"ptokens":[],"labels":["asus","firmware","high","homenetwork","infrastructure","routers"],"campaign_type":null,"search_a":"'-2026':12A,15A '-88707':13A,16A 'asus':1A 'crash':9A 'cve':11A,14A 'devic':10A 'firmwar':3A 'http':5A 'memori':8A 'overs':4A 'overwrit':7A 'paramet':6A 'router':2A","search_b":"'asus':17B,25B 'attack':49B 'bound':33B 'buffer':45B 'certain':24B 'could':50B 'crash':55B 'firmwar':18B,27B 'home':20B 'home-network':19B 'http':38B 'infrastructur':22B 'longer':42B 'memori':53B 'nearbi':48B 'network':21B 'out-of-bound':30B 'overwrit':51B 'paramet':41B 'request':39B 'router':23B,26B,57B 'trigger':35B 'unauthent':47B 'write':34B","search_c":"'advisori':111C 'allow':69C 'asus':66C,103C,109C 'bound':62C 'buffer':84C 'caus':92C 'certain':65C 'contain':79C 'crash':96C 'exceed':82C 'firmwar':68C,105C 'http':77C 'inform':114C 'length':85C 'memori':89C 'nearbi':72C 'out-of-bound':59C 'overwrit':87C 'paramet':80C 'potenti':86C 'refer':97C 'region':90C 'request':78C 'router':67C,104C 'section':106C 'secur':100C,110C 'send':75C 'system':94C 'unauthent':71C 'updat':101C 'user':73C 'write':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T02:16:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88707","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88707","severity":null,"published_at":"2026-11-10T02:16:45+00:00","modified_at":"2026-11-10T02:16:45+00:00","first_seen_at":"2026-11-10T02:49:23+00:00","fetched_at":"2026-11-10T02:49:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-88707:2404","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88707","severity":null,"published_at":"2026-11-10T02:51:42+00:00","modified_at":"2026-11-10T02:51:42+00:00","first_seen_at":"2026-11-10T02:51:42+00:00","fetched_at":"2026-11-10T02:51:42+00:00","note":"Could not reach ASUS's per-CVE advisory entry (index page table is JS-rendered/empty). NVD text only: models, firmware versions and fixed build unknown. Sibling CVEs 88708-88710 published same time. Nothing verified; fix status unknown, not 'none'. Settle by opening the 'Security Update for ASUS Router Firmware' entry on asus.com/security-advisory.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-88707","https://www.asus.com/security-advisory"]}],"documents":[{"id":112723,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88707","title":"NVD CVE-2026-88707","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2079,"url":"https://www.asus.com/security-advisory","title":"ASUS Product Security Advisory (index; bulletin table is JS-rendered)","kind":"advisory","source":"analyst","publisher":null,"text":"ASUS Product Security Advisory, Latest Security Updates table (read 2026-11-10):\nSecurity Update for ASUS Router Firmware | Security Bulletin | Affected: 3.0.0.4_386 series, 3.0.0.4_388 series, 3.0.0.6_102 series | CVE-2026-88707, CVE-2026-88708, CVE-2026-88709, CVE-2026-88710 | Published 11/10/2026 | Last updated 11/09/2026\nThe listing shows no fixed firmware versions or model list; the bulletin detail page was not reachable (JavaScript-rendered).\n","published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}