ASUS has released security updates to patch a critical vulnerability in its routers that could allow remote command execution without requiring administrative credentials.
The flaw, tracked as CVE-2026-13385, received a CVSS score of 9.5, indicating critical severity. It affects devices using firmware versions 3.0.0.4_386, 3.0.0.4_388, and 3.0.0.6_102, covering multiple lines of home routers and equipment used in small business environments.
The vulnerability arises from improper validation of digital certificates and mechanisms used to verify file integrity. These weaknesses can prevent the router from correctly confirming the authenticity of a server or received content.
Exploitation depends on a man-in-the-middle attack scenario and can occur on compromised networks, manipulated connections, or situations where an attacker interferes with traffic. No administrative credentials or owner interaction are required for successful exploitation.
Users should immediately install the latest firmware provided for each affected model. Additional recommendations include disabling unnecessary administrative features and reviewing any configuration settings that may have been altered without authorization.
