{"id":"CVE-2026-88709","kind":"vulnerability","aliases":["CVE-2026-88709"],"related":[],"title":"ASUS router firmware: USB directory name runs commands as root","description":"Improper\nneutralization of special elements used in an OS command in certain\nASUS Router firmware allows an user with physical access\nto\ninsert a USB device containing a specially crafted directory name, potentially\nexecuting arbitrary commands with root privileges.\nRefer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.","summary":"Certain ASUS router firmware builds pass a USB directory name to an OS command without neutralizing it. A person with physical access who plugs in a crafted USB device can run arbitrary commands with root privileges.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ASUS Router firmware","fixed":[],"affected":"3.0.0.4_386 series, 3.0.0.4_388 series, 3.0.0.6_102 series","ecosystem":"vendor"}],"ecosystems":[],"tags":["asus-router","infrastructure","router-firmware","usb"],"not_affected_if":["no-physical-access","no-usb-port"],"how_to_check":"In the router admin page (Administration > Firmware Upgrade) read the firmware version; if it begins 3.0.0.4_386, 3.0.0.4_388 or 3.0.0.6_102 it is in an affected series. Fixed build and model list are in the 'Security Update for ASUS Router Firmware' bulletin at https://www.asus.com/security-advisory (JavaScript page; not readable by us). Also check whether the router has a USB port and whether anyone untrusted can reach it.","fix":null,"status":"open","published_at":"2026-11-10T02:16:45+00:00","first_seen_at":"2026-11-10T02:49:23+00:00","triaged_at":"2026-11-10T02:50:05+00:00","updated_at":"2026-11-10T02:51:42+00:00","category":"infrastructure","confidence":0.55,"triage":{"at":"2026-11-10T02:50:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"ASUS router firmware: USB directory name runs commands as root","impact":"high","summary":"Certain ASUS router firmware builds pass a USB directory name to an OS command without neutralizing it. A person with physical access who plugs in a crafted USB device can run arbitrary commands with root privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["asus-router","router-firmware","usb"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary commands as root on the router","analyst_note":"Find the ASUS Security Advisory and list affected router models and fixed firmware versions, then confirm the fix.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-physical-access","no-usb-port"],"who_is_affected":"Affected firmware is on ASUS routers with a USB port, and the flaw needs someone with physical access to the device to insert a crafted USB drive. The sources do not name the affected models or firmware versions. Routers with no USB port or sealed in locked racks are not reachable this way.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":4570,"output_tokens":451,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the ASUS Security Advisory and list affected router models and fixed firmware versions, then confirm the fix.","search":"'-2026':12A,15A '-88709':13A,16A 'access':49B,84C 'advisori':117C 'allow':79C 'arbitrari':59B,98C 'asus':1A,17A,21B,29B,76C,109C,115C 'asus-rout':20B 'build':32B 'certain':28B,75C 'command':8A,41B,60B,73C,99C 'contain':90C 'craft':54B,93C 'cve':11A,14A 'devic':56B,89C 'directori':5A,36B,94C 'element':68C 'execut':97C 'firmwar':3A,26B,31B,78C,111C 'firmware':19A 'improp':64C 'inform':120C 'infrastructur':23B 'insert':86C 'name':6A,37B,95C 'neutral':43B,65C 'os':40B,72C 'pass':33B 'person':46B 'physic':48B,83C 'plug':51B 'potenti':96C 'privileg':63B,102C 'refer':103C 'root':10A,62B,101C 'router':2A,18A,22B,25B,30B,77C,110C 'router-firmwar':24B 'run':7A,58B 'section':112C 'secur':106C,116C 'special':67C,92C 'updat':107C 'usb':4A,27B,35B,55B,88C 'use':69C 'user':81C 'without':42B","nicknames":[],"mitigations":[],"who_affected":"ASUS routers on the 3.0.0.4_386, 3.0.0.4_388 or 3.0.0.6_102 firmware series, as listed by ASUS in its Router Firmware bulletin. Exploitation needs physical access to plug in a USB device with a crafted directory name; it is not remote. ASUS's listing does not name models or fixed versions. Routers with no USB port or in locked, controlled locations are low risk.","tier":"B","verified":{"products":{"at":"2026-11-10T02:51:42Z","by":"analyst","doc":"https://www.asus.com/security-advisory","run_id":2403}},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["asusrouterfirmware","routerfirmware"],"ptokens":["asus","firmware","router"],"labels":["asusrouter","high","infrastructure","routerfirmware","usb"],"campaign_type":null,"search_a":"'-2026':12A,15A '-88709':13A,16A 'asus':1A,17A 'command':8A 'cve':11A,14A 'directori':5A 'firmwar':3A 'firmware':19A 'name':6A 'root':10A 'router':2A,18A 'run':7A 'usb':4A","search_b":"'access':49B 'arbitrari':59B 'asus':21B,29B 'asus-rout':20B 'build':32B 'certain':28B 'command':41B,60B 'craft':54B 'devic':56B 'directori':36B 'firmwar':26B,31B 'infrastructur':23B 'name':37B 'neutral':43B 'os':40B 'pass':33B 'person':46B 'physic':48B 'plug':51B 'privileg':63B 'root':62B 'router':22B,25B,30B 'router-firmwar':24B 'run':58B 'usb':27B,35B,55B 'without':42B","search_c":"'access':84C 'advisori':117C 'allow':79C 'arbitrari':98C 'asus':76C,109C,115C 'certain':75C 'command':73C,99C 'contain':90C 'craft':93C 'devic':89C 'directori':94C 'element':68C 'execut':97C 'firmwar':78C,111C 'improp':64C 'inform':120C 'insert':86C 'name':95C 'neutral':65C 'os':72C 'physic':83C 'potenti':96C 'privileg':102C 'refer':103C 'root':101C 'router':77C,110C 'section':112C 'secur':106C,116C 'special':67C,92C 'updat':107C 'usb':88C 'use':69C 'user':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T02:16:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88709","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88709","severity":null,"published_at":"2026-11-10T02:16:45+00:00","modified_at":"2026-11-10T02:16:45+00:00","first_seen_at":"2026-11-10T02:49:23+00:00","fetched_at":"2026-11-10T02:49:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-88709:2403","url":"https://www.asus.com/security-advisory","severity":null,"published_at":"2026-11-10T02:51:42+00:00","modified_at":"2026-11-10T02:51:42+00:00","first_seen_at":"2026-11-10T02:51:42+00:00","fetched_at":"2026-11-10T02:51:42+00:00","note":"ASUS advisory listing (JS table, read in browser) names firmware series 3.0.0.4_386, 3.0.0.4_388, 3.0.0.6_102 for the Router Firmware bulletin covering CVE-2026-88707..88710. Bulletin detail with models and fixed builds not reachable; fix unknown. No exploitation/PoC found. web-cli search and X not used (search tool unavailable).","cites":["https://www.asus.com/security-advisory"]}],"documents":[{"id":2079,"url":"https://www.asus.com/security-advisory","title":"ASUS Product Security Advisory (index; bulletin table is JS-rendered)","kind":"advisory","source":"analyst","publisher":null,"text":"ASUS Product Security Advisory, Latest Security Updates table (read 2026-11-10):\nSecurity Update for ASUS Router Firmware | Security Bulletin | Affected: 3.0.0.4_386 series, 3.0.0.4_388 series, 3.0.0.6_102 series | CVE-2026-88707, CVE-2026-88708, CVE-2026-88709, CVE-2026-88710 | Published 11/10/2026 | Last updated 11/09/2026\nThe listing shows no fixed firmware versions or model list; the bulletin detail page was not reachable (JavaScript-rendered).\n","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}