{"id":"CVE-2026-88710","kind":"vulnerability","aliases":["CVE-2026-88710"],"related":[],"title":"ASUS router firmware: nearby attacker runs commands as root","description":"Improper\nneutralization of special elements used in an OS command in certain\nASUS Router firmware\nallows an unauthenticated nearby user to trigger a chain of\nactions—unauthenticated queries, identifier guessing, credential overwriting,\nand command injection—resulting in the execution of arbitrary commands with\nroot privileges.\nRefer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.","summary":"Certain ASUS router firmware builds let an unauthenticated user nearby chain unauthenticated queries, identifier guessing, and credential overwriting to inject OS commands. A successful attack runs arbitrary commands with root privileges on the router.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ASUS Router firmware","fixed":[],"affected":"3.0.0.4.386 series, 3.0.0.4.388 series, 3.0.0.6.102 series","ecosystem":"vendor"}],"ecosystems":[],"tags":["asus","firmware","home-network","infrastructure","routers"],"not_affected_if":["other-firmware-series","patched-firmware","unaffected-model"],"how_to_check":"- Find your router's firmware version in the admin page (Administration > Firmware Upgrade) and check whether it starts with 3.0.0.4.386, 3.0.0.4.388 or 3.0.0.6.102.\n- Compare with the newest firmware for your model on asus.com/support and install it; ASUS's bulletin 'Security Update for ASUS Router Firmware' does not give a fixed build in the pages I could read.\n- Until updated: keep untrusted devices off your Wi-Fi/LAN, use strong Wi-Fi and admin passwords, turn off guest access you don't need.","fix":null,"status":"open","published_at":"2026-11-10T02:16:45+00:00","first_seen_at":"2026-11-10T02:49:23+00:00","triaged_at":"2026-11-10T02:50:06+00:00","updated_at":"2026-11-10T02:51:58+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T02:50:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"ASUS router firmware: nearby attacker runs commands as root","impact":"high","summary":"Certain ASUS router firmware builds let an unauthenticated user nearby chain unauthenticated queries, identifier guessing, and credential overwriting to inject OS commands. A successful attack runs arbitrary commands with root privileges on the router.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["asus","routers","firmware","home-network"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary commands as root on the router","analyst_note":"Check the ASUS Security Advisory for affected models, fixed firmware versions and any mitigation for this CVE.","how_to_check":"- Check the installed firmware version in the router admin page under Administration or System Log, then compare it with the affected ranges in the ASUS Security Advisory.\n- Confirm whether the router's management interface is reachable from networks outside your own.","plain_action":"Update your ASUS router's firmware through the ASUS Security Update section of the ASUS Security Advisory, if your model is listed there.","product_name":"","needs_analyst":true,"not_affected_if":["patched-firmware","unaffected-model"],"who_is_affected":"Owners of the listed ASUS router models running affected firmware are exposed, and the attacker must be on a nearby network segment such as Wi-Fi or the LAN. Routers with no affected firmware, or with the vendor update applied, are not exposed. The sources do not list the affected models or versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000754,"input_tokens":4598,"output_tokens":588,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the ASUS Security Advisory for affected models, fixed firmware versions and any mitigation for this CVE.","search":"'-2026':11A,14A '-88710':12A,15A 'action':85C 'advisori':119C 'allow':75C 'arbitrari':52B,100C 'asus':1A,16A,19B,27B,72C,111C,117C 'attack':5A,50B 'build':30B 'certain':26B,71C 'chain':36B,83C 'command':7A,47B,53B,69C,93C,101C 'credenti':42B,90C 'cve':10A,13A 'element':64C 'execut':98C 'firmwar':3A,20B,29B,74C,113C 'firmware':18A 'guess':40B,89C 'home':22B 'home-network':21B 'identifi':39B,88C 'improp':60C 'inform':122C 'infrastructur':24B 'inject':45B,94C 'let':31B 'nearbi':4A,35B,78C 'network':23B 'neutral':61C 'os':46B,68C 'overwrit':43B,91C 'privileg':56B,104C 'queri':38B,87C 'refer':105C 'result':95C 'root':9A,55B,103C 'router':2A,17A,25B,28B,59B,73C,112C 'run':6A,51B 'section':114C 'secur':108C,118C 'special':63C 'success':49B 'trigger':81C 'unauthent':33B,37B,77C,86C 'updat':109C 'use':65C 'user':34B,79C","nicknames":[],"mitigations":[],"who_affected":"ASUS routers running firmware in the 3.0.0.4.386 (custom), 3.0.0.4.388 or 3.0.0.6.102 series are listed in the CVE record. An attacker on the same network (Wi-Fi or LAN) with no login can chain unauthenticated queries, identifier guessing and credential overwriting into root command execution. ASUS does not name affected models or a fixed build in the data I could read; routers on other firmware series are not listed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":null,"pkeys":["asusrouterfirmware","routerfirmware"],"ptokens":["asus","firmware","router"],"labels":["asus","firmware","high","homenetwork","infrastructure","routers"],"campaign_type":null,"search_a":"'-2026':11A,14A '-88710':12A,15A 'asus':1A,16A 'attack':5A 'command':7A 'cve':10A,13A 'firmwar':3A 'firmware':18A 'nearbi':4A 'root':9A 'router':2A,17A 'run':6A","search_b":"'arbitrari':52B 'asus':19B,27B 'attack':50B 'build':30B 'certain':26B 'chain':36B 'command':47B,53B 'credenti':42B 'firmwar':20B,29B 'guess':40B 'home':22B 'home-network':21B 'identifi':39B 'infrastructur':24B 'inject':45B 'let':31B 'nearbi':35B 'network':23B 'os':46B 'overwrit':43B 'privileg':56B 'queri':38B 'root':55B 'router':25B,28B,59B 'run':51B 'success':49B 'unauthent':33B,37B 'user':34B","search_c":"'action':85C 'advisori':119C 'allow':75C 'arbitrari':100C 'asus':72C,111C,117C 'certain':71C 'chain':83C 'command':69C,93C,101C 'credenti':90C 'element':64C 'execut':98C 'firmwar':74C,113C 'guess':89C 'identifi':88C 'improp':60C 'inform':122C 'inject':94C 'nearbi':78C 'neutral':61C 'os':68C 'overwrit':91C 'privileg':104C 'queri':87C 'refer':105C 'result':95C 'root':103C 'router':73C,112C 'section':114C 'secur':108C,118C 'special':63C 'trigger':81C 'unauthent':77C,86C 'updat':109C 'use':65C 'user':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T02:16:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88710","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88710","severity":null,"published_at":"2026-11-10T02:16:45+00:00","modified_at":"2026-11-10T02:16:45+00:00","first_seen_at":"2026-11-10T02:49:23+00:00","fetched_at":"2026-11-10T02:49:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-88710:2402","url":"https://www.asus.com/security-advisory","severity":null,"published_at":"2026-11-10T02:51:58+00:00","modified_at":"2026-11-10T02:51:58+00:00","first_seen_at":"2026-11-10T02:51:58+00:00","fetched_at":"2026-11-10T02:51:58+00:00","note":"CVE record (ASUS CNA) read via circl mirror: affected series 3.0.0.4.386/388, 3.0.0.6.102; AV:A CVSS4 8.7. ASUS advisory page table is JS-rendered, so no fixed build, model list or bulletin text read; nothing marked verified. No exploitation or PoC found. X and social not checked. Fix unknown: settle by reading the ASUS bulletin entry.","cites":["https://www.asus.com/security-advisory","https://cvepremium.circl.lu/vuln/cve-2026-88710"]}],"documents":[{"id":2079,"url":"https://www.asus.com/security-advisory","title":"ASUS Product Security Advisory (index; bulletin table is JS-rendered)","kind":"advisory","source":"analyst","publisher":null,"text":"ASUS Product Security Advisory, Latest Security Updates table (read 2026-11-10):\nSecurity Update for ASUS Router Firmware | Security Bulletin | Affected: 3.0.0.4_386 series, 3.0.0.4_388 series, 3.0.0.6_102 series | CVE-2026-88707, CVE-2026-88708, CVE-2026-88709, CVE-2026-88710 | Published 11/10/2026 | Last updated 11/09/2026\nThe listing shows no fixed firmware versions or model list; the bulletin detail page was not reachable (JavaScript-rendered).\n","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":112726,"url":"https://cvepremium.circl.lu/vuln/cve-2026-88710","title":"CVE-2026-88710 CVE record (ASUS CNA) via Vulnerability-Lookup","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}