---
id: "CVE-2026-93489"
kind: "vulnerability"
aliases: ["CVE-2026-93489"]
title: "ASUS router firmware: forged access ticket grants administrator control"
severity: "high"
cvss: 8.7
epss: 0.00189
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "ASUS Router Firmware", "fixed": [], "affected": "3.0.0.6_102 series", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["asus", "firmware", "infrastructure", "routers", "self-hosted"]
not_affected_if: ["firmware-outside-3.0.0.6_102-series", "no-asus-router", "non-asus-router"]
published_at: "2026-10-23T08:16:55+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93489", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:37:42+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-93489", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# ASUS router firmware: forged access ticket grants administrator control

Improper authentication (CWE-287) in ASUS router firmware, 3.0.0.6_102 series. An unauthenticated attacker on an adjacent network can send an HTTP request, forge an access ticket and perform any administrator operation (change config, create accounts, change network settings). CVSS 4.0 8.7, AV:A. Reported by MrBruh. Same ASUS advisory also covers CVE-2026-75775 and CVE-2026-75779. No public PoC or exploitation evidence at publication (2026-10-23).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ASUS Router Firmware affected 3.0.0.6_102 series fixed ?

## How to check

Log in to the router web UI (Administration > Firmware Upgrade) and read the firmware version. A 3.0.0.6_102.x build is in the affected series. Then compare it with the latest firmware for your exact model on asus.com/support; ASUS's page gives no per-model fixed build number. Also check whether the web admin is reachable from the WAN or from untrusted LAN/Wi-Fi devices.

## Fix

Install the latest ASUS firmware for your exact model (ASUS 'Security Update for ASUS Router Firmware'), then reboot. The exact fixed build is unknown: the advisory table did not render for me, and ASUS's page would settle it. Until then: disable WAN access to the admin UI, limit management to trusted LAN, keep untrusted devices off the network, use strong unique admin passwords, and review linked devices and app sessions.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93489
- 2026-10-23T23:37:42+00:00 analyst — CVE record (ASUS CNA) + ASUS advisory index + press read. Affected: ASUS router firmware 3.0.0.6_102 series; no per-model fixed build found (ASUS advisory table did not render; no fixed version stated). No PoC or exploitation evidence found; X shows 1 post, none worth saving. Same advisory also covers CVE-2026-75775 and CVE-2026-75779 (sibling signals). Severity unchanged (CVSS 4.0 8.7, adjacent network).
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-93489

## Documents

- [advisory] ASUS Product Security Advisory (index; update table did not render) https://www.asus.com/security-advisory
- [describes] CVE Record CVE-2026-93489 (ASUS CNA) https://www.cve.org/CVERecord?id=CVE-2026-93489
- [mentions] Routers ASUS: tres fallos y cómo revisar el firmware https://tecnologiatoday.com/ciberseguridad/asus-routers-tres-fallos-firmware-acceso-remoto-csrf-4268/

## From the sources

Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations.
Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_