{"id":"CVE-2026-93489","kind":"vulnerability","aliases":["CVE-2026-93489"],"related":[],"title":"ASUS router firmware: forged access ticket grants administrator control","description":"Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations.\nRefer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.","summary":"Improper authentication (CWE-287) in ASUS router firmware, 3.0.0.6_102 series. An unauthenticated attacker on an adjacent network can send an HTTP request, forge an access ticket and perform any administrator operation (change config, create accounts, change network settings). CVSS 4.0 8.7, AV:A. Reported by MrBruh. Same ASUS advisory also covers CVE-2026-75775 and CVE-2026-75779. No public PoC or exploitation evidence at publication (2026-10-23).","severity":"high","cvss":8.7,"epss":0.00189,"exploited":false,"exploited_at":null,"products":[{"name":"ASUS Router Firmware","fixed":[],"affected":"3.0.0.6_102 series","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["asus","firmware","infrastructure","routers","self-hosted"],"not_affected_if":["firmware-outside-3.0.0.6_102-series","no-asus-router","non-asus-router"],"how_to_check":"Log in to the router web UI (Administration > Firmware Upgrade) and read the firmware version. A 3.0.0.6_102.x build is in the affected series. Then compare it with the latest firmware for your exact model on asus.com/support; ASUS's page gives no per-model fixed build number. Also check whether the web admin is reachable from the WAN or from untrusted LAN/Wi-Fi devices.","fix":"Install the latest ASUS firmware for your exact model (ASUS 'Security Update for ASUS Router Firmware'), then reboot. The exact fixed build is unknown: the advisory table did not render for me, and ASUS's page would settle it. Until then: disable WAN access to the admin UI, limit management to trusted LAN, keep untrusted devices off the network, use strong unique admin passwords, and review linked devices and app sessions.","status":"open","published_at":"2026-10-23T08:16:55+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:35:05+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T22:35:05Z","model":"claude-haiku-5-5","output":{"fix":"Update ASUS router firmware to the version listed in the ASUS Security Advisory 'Security Update for ASUS Router Firmware' (version not stated in the source).","reach":"network","title":"ASUS router firmware: forged access ticket grants administrator control","impact":"high","summary":"ASUS router modules have an authentication flaw that lets an unauthenticated user on a nearby network send an HTTP request and forge an access ticket. The forged ticket lets the attacker perform administrator operations on the router.","category":"infrastructure","who_cares":["asus","routers","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"attacker gains router administrator access from nearby network","analyst_note":"Find affected ASUS models and fixed firmware versions in the ASUS Security Advisory referenced by the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-93489.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-asus-router"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000489,"input_tokens":2916,"output_tokens":395,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected ASUS models and fixed firmware versions in the ASUS Security Advisory referenced by the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-93489.","search":"'-10':94B '-2026':11A,14A,79B,83B '-23':95B '-287':29B '-75775':80B '-75779':84B '-93489':12A,15A '102':35B '2026':93B '3.0.0.6':34B '4.0':66B '8.7':67B 'access':5A,51B,115C 'account':61B 'adjac':42B 'administr':8A,56B,123C 'advisori':75B,139C 'allow':102C 'also':76B 'asus':1A,16A,19B,31B,74B,99C,131C,137C 'attack':39B 'authent':27B,97C 'av':68B 'chang':58B,62B 'config':59B 'control':9A 'cover':77B 'creat':60B 'cve':10A,13A,78B,82B 'cvss':65B 'cwe':28B 'enabl':118C 'evid':90B 'exploit':89B 'firmwar':3A,20B,33B,133C 'firmware':18A 'forg':4A,49B,113C 'grant':7A 'host':25B 'http':47B,110C 'improp':26B,96C 'inform':142C 'infrastructur':21B 'modul':101C 'mrbruh':72B 'nearbi':105C 'network':43B,63B 'oper':57B,124C 'perform':54B,122C 'poc':87B 'public':86B,92B 'refer':125C 'report':70B 'request':48B,111C 'router':2A,17A,22B,32B,100C,132C 'section':134C 'secur':128C,138C 'self':24B 'self-host':23B 'send':45B,108C 'seri':36B 'set':64B 'subsequ':117C 'ticket':6A,52B,116C 'unauthent':38B,104C 'updat':129C 'user':106C,120C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T08:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93489","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93489","severity":null,"published_at":"2026-10-23T08:16:55+00:00","modified_at":"2026-10-23T19:42:24+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-93489:482","url":null,"severity":null,"published_at":"2026-10-23T23:37:42+00:00","modified_at":"2026-10-23T23:37:42+00:00","first_seen_at":"2026-10-23T23:37:42+00:00","fetched_at":"2026-10-23T23:37:42+00:00","note":"CVE record (ASUS CNA) + ASUS advisory index + press read. Affected: ASUS router firmware 3.0.0.6_102 series; no per-model fixed build found (ASUS advisory table did not render; no fixed version stated). No PoC or exploitation evidence found; X shows 1 post, none worth saving. Same advisory also covers CVE-2026-75775 and CVE-2026-75779 (sibling signals). Severity unchanged (CVSS 4.0 8.7, adjacent network)."},{"source":"epss","external_id":"CVE-2026-93489","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93489","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":2079,"url":"https://www.asus.com/security-advisory","title":"ASUS Product Security Advisory (index; update table did not render)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2081,"url":"https://www.cve.org/CVERecord?id=CVE-2026-93489","title":"CVE Record CVE-2026-93489 (ASUS CNA)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2080,"url":"https://tecnologiatoday.com/ciberseguridad/asus-routers-tres-fallos-firmware-acceso-remoto-csrf-4268/","title":"Routers ASUS: tres fallos y cómo revisar el firmware","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}