---
id: "CVE-2026-88707"
page: "https://infrastack.ai/live/CVE-2026-88707"
kind: "vulnerability"
aliases: ["CVE-2026-88707"]
title: "ASUS Router firmware: oversized HTTP parameters overwrite memory, crash device"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["asus", "firmware", "home-network", "infrastructure", "routers"]
not_affected_if: ["no-local-network-access", "unaffected-firmware"]
published_at: "2026-11-10T02:16:45+00:00"
first_seen_at: "2026-11-10T02:49:23+00:00"
updated_at: "2026-11-10T02:51:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88707", "first_seen_at": "2026-11-10T02:49:23+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88707", "first_seen_at": "2026-11-10T02:51:42+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-88707", "https://www.asus.com/security-advisory"]}]
exploit_sources: []
---

# ASUS Router firmware: oversized HTTP parameters overwrite memory, crash device

Link for people: https://infrastack.ai/live/CVE-2026-88707 (this .md is for agents)

Certain ASUS router firmware has an out-of-bounds write triggered by an HTTP request with parameters longer than a buffer. An unauthenticated nearby attacker could overwrite other memory or crash the router.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Find your router model and firmware version in the admin page (Administration > Firmware Upgrade), then compare with the 'Security Update for ASUS Router Firmware' entry on https://www.asus.com/security-advisory. The ASUS entry was not readable by us, so affected models and the fixed build are unknown. Also check ASUS's support page for your model for a firmware build newer than your current one.

## Timeline

- 2026-11-10T02:49:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88707
- 2026-11-10T02:51:42+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-88707 — Could not reach ASUS's per-CVE advisory entry (index page table is JS-rendered/empty). NVD text only: models, firmware versions and fixed build unknown. Sibling CVEs 88708-88710 published same time. Nothing verified; fix status unknown, not 'none'. Settle by opening the 'Security Update for ASUS Router Firmware' entry on asus.com/security-advisory.

## Documents

- [describes] NVD CVE-2026-88707 https://nvd.nist.gov/vuln/detail/CVE-2026-88707
- [mentions] ASUS Product Security Advisory (index; bulletin table is JS-rendered) https://www.asus.com/security-advisory

## From the sources

An
out-of-bounds write in certain ASUS Router firmware
allows an unauthenticated nearby user to send an HTTP request containing
parameters that exceed the buffer length, potentially overwriting other memory
regions or causing the system to crash.
Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_