CVE-2026-75753
Received Received - Intake

Missing Authentication in ASUS Router Firmware

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: ASUS

Description
Missing Authentication for a Critical Function  in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to return device identification information and switch into a specific mode. As a result, when the router encounters abnormal conditions, it may be unable to perform self-recovery. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-75753
EUVD
EUVD-2026-104784

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ASUS Router 3.0.0.4.388 series

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves missing authentication in certain ASUS routers. An unauthorized nearby user can send specific HTTP commands to retrieve device identification information and force the router into a special mode. This may prevent the router from recovering automatically during abnormal conditions.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized HTTP requests targeting ASUS routers. Check for unusual commands or responses related to device identification or mode switching. Use tools like Wireshark or tcpdump to capture and analyze traffic.

Impact Analysis

An attacker could exploit this to gather sensitive device details or disrupt router functionality, potentially leading to network instability or loss of connectivity. The lack of authentication means anyone nearby could attempt this attack without needing credentials.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to device identification information. Unauthorized access to network devices may violate data protection requirements under these regulations, depending on how the device is used in handling sensitive data.

Mitigation Strategies

Immediately update the ASUS router firmware to the latest version from the official ASUS Security Advisory. Disable remote access to the router's web interface if not required. Ensure strong, unique passwords are set for all router accounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75753. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart