ASUS vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited ASUS flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2025-59374 ASUS Live Update Embedded Malicious CodeExploited since Dec 17, 2025 · CVSS 9.3
• CVE-2023-39780 ASUS RT-AX55 Routers OS Command InjectionExploited since Jun 2, 2025 · CVSS 8.8
• CVE-2021-32030 ASUS Routers Improper AuthenticationExploited since Jun 2, 2025 · CVSS 9.8

Latest high and critical flaws

• CVE-2026-93489 Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling tHigh 8.7 · Oct 23, 2026
• CVE-2026-75779 Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow aHigh 8.6 · Oct 23, 2026
• CVE-2026-75775 Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges High 7.7 · Oct 23, 2026
• CVE-2026-17518 Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial oHigh 8.2 · Oct 19, 2026
• CVE-2026-102438 An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of aHigh 8.5 · Oct 19, 2026
• CVE-2026-14911 Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, moCritical 9.3 · Oct 6, 2026
• CVE-2026-19396 A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearbHigh 7.7 · Oct 6, 2026
• CVE-2026-19386 A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload tCritical 9.3 · Oct 6, 2026
• CVE-2026-16528 Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the systemHigh 8.4 · Oct 6, 2026
• CVE-2026-93495 Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted deHigh 7 · Sep 30, 2026
• CVE-2026-14157 Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploCritical 9.4 · Sep 30, 2026
• CVE-2026-13313 An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms aHigh 8.9 · Sep 30, 2026
• CVE-2026-19397 Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct conneHigh 7.7 · Sep 7, 2026
• CVE-2026-75754 Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorizedCritical 10 · Sep 3, 2026
• CVE-2026-8917 Untrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a local attacker to write a specific valueHigh 8.4 · Aug 10, 2026
• CVE-2026-16727 Concurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”) in ASUS Armoury Crate allows a local user to execute arbitrary code High 7.3 · Jul 29, 2026
• CVE-2019-25764 **UNSUPPORTED WHEN ASSIGNED**  Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a local user to bypass the driver's verificatiHigh 7.3 · Jul 17, 2026
• CVE-2026-8920 Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to peHigh 8.5 · Jul 14, 2026
• CVE-2026-8919 Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user toHigh 7.2 · Jul 14, 2026
• CVE-2026-15029 Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to perfHigh 8.4 · Jul 14, 2026
• CVE-2026-13585 Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface driverHigh 8.2 · Jul 14, 2026
• CVE-2026-13385 An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middle(MITM) user tCritical 9.5 · Jul 14, 2026
• CVE-2026-8921 External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tamperedHigh 8.5 · Jul 2, 2026
• CVE-2022-4990 ** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to bypass security validatiHigh 7.3 · Jul 2, 2026
• CVE-2022-4989 ** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to access unintended memoryHigh 8.5 · Jul 2, 2026