ASUS Fixes Critical Router Flaw Allowing Command Execution in MITM Attacks

ASUS has patched a critical router vulnerability that could allow a remote man-in-the-middle attacker to make an affected device download and execute arbitrary commands. The flaw is tracked as CVE-2026-13385 and carries a CVSS 4.0 score of 9.5.

The vulnerability affects certain ASUS routers running firmware from the 3.0.0.4_386, 3.0.0.4_388, and 3.0.0.6_102 branches. However, these branch numbers cover many devices and do not mean every ASUS router using them is vulnerable.

According to the official ASUS Product Security Advisory, customers should install the latest firmware available for their specific router model. The attack requires a network position that lets the threat actor intercept and modify communications between the router and a legitimate service.

What is CVE-2026-13385?

Category	Details
CVE	CVE-2026-13385
Severity	Critical
CVSS score	9.5 under CVSS 4.0
Vulnerability types	Improper certificate validation and improper integrity-check validation
Attack vector	Network
Required privileges	None
User interaction	None
Special requirement	The attacker must perform a man-in-the-middle attack
Potential result	The router downloads and executes an arbitrary command from a spoofed server

The CVE-2026-13385 record identifies two weaknesses behind the vulnerability: CWE-295, improper certificate validation, and CWE-354, improper validation of an integrity-check value.

These weaknesses could prevent the router from reliably confirming that it had reached the genuine server and received authentic content. A suitably positioned attacker could impersonate that server and provide a malicious response.

The flaw requires a man-in-the-middle position

CVE-2026-13385 should not be confused with an unauthenticated router-management flaw that anyone can exploit by sending a request to an exposed web interface. The attacker must first gain the ability to observe and alter the router’s relevant network traffic.

This position could arise through control of a network gateway, compromised infrastructure, DNS manipulation combined with traffic interception, or another technique that places the attacker between the router and its intended service.

Once in that position, the attacker could direct the router toward a spoofed server. The router’s insufficient certificate and integrity validation could then allow it to accept and execute attacker-supplied commands.

• The attacker does not need the router’s administrator password.
• The router owner does not need to click a link or approve a prompt.
• The attack requires interception and modification of network communications.
• The attacker must successfully impersonate the expected server.
• The router must run affected firmware and use the vulnerable functionality.

Which ASUS routers are affected?

The public CVE record lists three affected ASUS firmware families: 3.0.0.4_386, 3.0.0.4_388, and 3.0.0.6_102. It does not provide a complete public list of individual router model numbers.

Additional reporting based on ASUS advisory information says the vulnerability applies to certain CN SKU models that use the UU feature. The CN designation generally refers to products and firmware intended for the Chinese market.

The narrower scope matters because the same broad firmware branch can appear across routers sold in different regions. An analysis of the ASUS security updates reports that other regional versions and routers without the affected UU functionality do not share this specific exposure.

Firmware branch	Public CVE status
3.0.0.4_386 series	Affected on certain router models
3.0.0.4_388 series	Affected on certain router models
3.0.0.6_102 series	Affected on certain router models
Other ASUS firmware branches	Not identified as affected by this CVE

Users should check the full model name printed on the router label or displayed in the administration interface. Comparing only the beginning of a firmware version may produce an inaccurate result.

How the ASUS router attack works

The router communicates with an external service while using the affected feature. It should verify both the server’s identity and the integrity of any data it receives before acting on that response.

CVE-2026-13385 weakens both checks. The router can accept a spoofed server and fail to detect that an attacker has substituted unauthorized content or commands.

The official vulnerability assessment says successful exploitation can make the router download and execute an arbitrary command. Its CVSS vector assigns high impact to confidentiality, integrity, and availability on both the vulnerable device and connected systems.

1. The router contacts a service used by the affected functionality.
2. The attacker intercepts the communication.
3. The attacker impersonates the expected server.
4. The spoofed server returns attacker-controlled content.
5. The router fails to validate the certificate or integrity value correctly.
6. The router downloads and executes the supplied command.

What an attacker could do after exploitation

Arbitrary command execution can give an attacker extensive control over a router, depending on the privileges of the vulnerable process. Routers occupy a trusted position between local devices and the internet, making a compromise particularly serious.

An attacker could potentially modify network settings, redirect traffic, interfere with DNS requests, disrupt connectivity, or use the router as an entry point for further attacks. The CVSS assessment reflects the possibility of a total technical impact.

However, ASUS has not stated that CVE-2026-13385 has been used to deploy ransomware, create botnets, or intercept customer traffic. Those outcomes represent possible consequences of router command execution, not confirmed activity linked to this vulnerability.

• Alter DNS and routing configurations
• Redirect users to malicious services
• Monitor or interfere with unencrypted traffic
• Create persistent unauthorized access
• Use the router as a proxy or attack relay
• Disrupt internet and local network availability

ASUS assigns the flaw a critical 9.5 score

ASUS calculated a CVSS 4.0 base score of 9.5. The vector records a network attack with low complexity, no required privileges, and no user interaction.

The score also includes an attack requirement, reflecting the need for a man-in-the-middle position. This condition makes exploitation less direct than scanning the internet and sending one malicious request to every vulnerable router.

Despite that prerequisite, successful exploitation could have a severe effect. A router may process the attacker’s command automatically once the spoofed communication reaches the vulnerable component.

CVSS factor	Assessment
Attack vector	Network
Attack complexity	Low
Attack requirements	Present
Privileges required	None
User interaction	None
Confidentiality impact	High
Integrity impact	High
Availability impact	High

How to update an ASUS router

ASUS recommends installing the newest firmware released for each affected model. Users should access the administration page from a device connected to the local network and avoid performing the update through an untrusted public network.

In ASUSWRT, the update controls generally appear under Administration, followed by Firmware Upgrade. Interface names can differ between router models and firmware generations.

The latest ASUS security guidance advises customers to keep firmware and software current. Users should obtain updates through the router’s built-in update system or the official ASUS support page for their exact model.

1. Find the complete model name on the router label.
2. Sign in to the router’s local administration interface.
3. Record the currently installed firmware version.
4. Check for an update through the Firmware Upgrade section.
5. Install the newest firmware offered for that exact model and region.
6. Allow the router to restart without interrupting the process.
7. Sign in again and confirm that the new version is active.

Additional steps to protect ASUS routers

Users should disable remote administration from the WAN unless they have a clear operational need for it. This action does not repair CVE-2026-13385, but it reduces exposure to separate attacks against the management interface.

Administrators should also use a unique router password, disable unused services, and review DNS and port-forwarding settings after updating. Unexpected changes could indicate a previous compromise or another configuration problem.

Owners of unsupported routers should check whether ASUS still provides security firmware for their models. If an affected product has reached end of life and cannot receive the correction, replacing it offers the safest response.

• Use a long and unique administrator password.
• Disable WAN administration when it is unnecessary.
• Turn off unused features and services.
• Review DNS, VPN, and port-forwarding configurations.
• Check connected-device lists for unfamiliar systems.
• Replace end-of-life routers that no longer receive patches.

No confirmed exploitation was reported

CISA’s vulnerability-enrichment data marked exploitation as none when it assessed CVE-2026-13385 on July 15, 2026. This classification means no confirmed exploitation was identified in the information available to that assessment.

Public exploit status can change after researchers or attackers study a newly disclosed flaw. Router owners should therefore update promptly instead of waiting for evidence of widespread attacks.

The limited CN SKU and UU-feature scope also means the vulnerability does not threaten every ASUS router worldwide. The available advisory analysis supports checking the exact model, region, enabled functionality, and installed firmware before determining exposure.

FAQ