---
id: "CVE-2026-88709"
page: "https://infrastack.ai/live/CVE-2026-88709"
kind: "vulnerability"
aliases: ["CVE-2026-88709"]
title: "ASUS router firmware: USB directory name runs commands as root"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "ASUS Router firmware", "fixed": [], "affected": "3.0.0.4_386 series, 3.0.0.4_388 series, 3.0.0.6_102 series", "ecosystem": "vendor"}]
ecosystems: []
tags: ["asus-router", "infrastructure", "router-firmware", "usb"]
not_affected_if: ["no-physical-access", "no-usb-port"]
published_at: "2026-11-10T02:16:45+00:00"
first_seen_at: "2026-11-10T02:49:23+00:00"
updated_at: "2026-11-10T02:51:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88709", "first_seen_at": "2026-11-10T02:49:23+00:00"}, {"source": "analyst", "url": "https://www.asus.com/security-advisory", "first_seen_at": "2026-11-10T02:51:42+00:00", "cites": ["https://www.asus.com/security-advisory"]}]
exploit_sources: []
---

# ASUS router firmware: USB directory name runs commands as root

Link for people: https://infrastack.ai/live/CVE-2026-88709 (this .md is for agents)

Certain ASUS router firmware builds pass a USB directory name to an OS command without neutralizing it. A person with physical access who plugs in a crafted USB device can run arbitrary commands with root privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ASUS Router firmware affected 3.0.0.4_386 series, 3.0.0.4_388 series, 3.0.0.6_102 series fixed no fixed version listed

## How to check

In the router admin page (Administration > Firmware Upgrade) read the firmware version; if it begins 3.0.0.4_386, 3.0.0.4_388 or 3.0.0.6_102 it is in an affected series. Fixed build and model list are in the 'Security Update for ASUS Router Firmware' bulletin at https://www.asus.com/security-advisory (JavaScript page; not readable by us). Also check whether the router has a USB port and whether anyone untrusted can reach it.

## Timeline

- 2026-11-10T02:49:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88709
- 2026-11-10T02:51:42+00:00 analyst https://www.asus.com/security-advisory — ASUS advisory listing (JS table, read in browser) names firmware series 3.0.0.4_386, 3.0.0.4_388, 3.0.0.6_102 for the Router Firmware bulletin covering CVE-2026-88707..88710. Bulletin detail with models and fixed builds not reachable; fix unknown. No exploitation/PoC found. web-cli search and X not used (search tool unavailable).

## Documents

- [advisory] ASUS Product Security Advisory (index; bulletin table is JS-rendered) https://www.asus.com/security-advisory

## From the sources

Improper
neutralization of special elements used in an OS command in certain
ASUS Router firmware allows an user with physical access
to
insert a USB device containing a specially crafted directory name, potentially
executing arbitrary commands with root privileges.
Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_