ASUS ROUTER FIRMWARE · CVE-2026-88710 · Infrastructure
NO FIX YET
Certain ASUS router firmware builds let an unauthenticated user nearby chain unauthenticated queries, identifier guessing, and credential overwriting to inject OS commands. A successful attack runs arbitrary commands with root privileges on the router.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
ASUS routers running firmware in the 3.0.0.4.386 (custom), 3.0.0.4.388 or 3.0.0.6.102 series are listed in the CVE record. An attacker on the same network (Wi-Fi or LAN) with no login can chain unauthenticated queries, identifier guessing and credential overwriting into root command execution. ASUS does not name affected models or a fixed build in the data I could read; routers on other firmware series are not listed.
Not affected if other-firmware-series, patched-firmware, unaffected-model
Who cares asus, firmware, home-network, routers
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an unauthenticated nearby user to trigger a chain of actions—unauthenticated queries, identifier guessing, credential overwriting, and command injection—resulting in the execution of arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.