Live › vulnerability › CVE-2026-93489
Go to dashboardImproper authentication (CWE-287) in ASUS router firmware, 3.0.0.6_102 series. An unauthenticated attacker on an adjacent network can send an HTTP request, forge an access ticket and perform any administrator operation (change config, create accounts, change network settings). CVSS 4.0 8.7, AV:A. Reported by MrBruh. Same ASUS advisory also covers CVE-2026-75775 and CVE-2026-75779. No public PoC or exploitation evidence at publication (2026-10-23).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| ASUS Router Firmware | vendor | 3.0.0.6_102 series | – |
3.0.0.6_102.x build is in the affected seriesSecurity Update for ASUS Router Firmware), then rebootEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
This page as .md · .json · in your agent: get_signal("CVE-2026-93489")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.