ASUS ROUTER FIRMWARE · CVE-2026-88709 · Infrastructure
NO FIX YET
Certain ASUS router firmware builds pass a USB directory name to an OS command without neutralizing it. A person with physical access who plugs in a crafted USB device can run arbitrary commands with root privileges.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
ASUS routers on the 3.0.0.4_386, 3.0.0.4_388 or 3.0.0.6_102 firmware series, as listed by ASUS in its Router Firmware bulletin. Exploitation needs physical access to plug in a USB device with a crafted directory name; it is not remote. ASUS's listing does not name models or fixed versions. Routers with no USB port or in locked, controlled locations are low risk.
Not affected if no-physical-access, no-usb-port
Who cares asus-router, router-firmware, usb
3.0.0.4_386, 3.0.0.4_388 or 3.0.0.6_102 it is in an affected seriesSecurity Update for ASUS Router Firmware bulletin at https://www.asus.com/security-advisory (JavaScript page; not readable by us)Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an user with physical access to insert a USB device containing a specially crafted directory name, potentially executing arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
This page as .md · .json · CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Unknown from the sources.