CVE-2026-13385

Deferred Deferred - Pending Action

Improper Certificate Validation in ASUS Router Firmware

Publication date: 2026-07-15

Last updated on: 2026-07-29

Assigner: ASUS

Description

An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middle(MITM) user to make the router download and execute arbitrary command via a spoofed server. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-29

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-03

NVD

CVE-2026-13385

EUVD

EUVD-2026-44590

Affected Vendors & Products

Vendor	Product	Version / Range
asus	router_firmware	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-354	The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper validation of integrity checks and certificate validation in ASUS routers. A remote attacker can exploit this by acting as a man-in-the-middle to trick the router into downloading and executing arbitrary commands via a spoofed server.

Detection Guidance

This vulnerability involves improper validation of integrity checks and certificate validation in ASUS routers, allowing MITM attacks. Detection requires checking router firmware versions and network traffic for spoofed servers. Use ASUS's official tools or firmware update checks to verify if your router is affected. Monitor network traffic for unusual download requests or unauthorized command executions.

Impact Analysis

An attacker could intercept your network traffic, install malware on your router, or gain unauthorized access to your network. This may lead to data theft, unauthorized device control, or disruption of network services.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and integrity. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Update ASUS router firmware to the latest version as recommended in the ASUS Security Advisory. Disable remote management features if not required and monitor network traffic for unusual activity.

Hi! I’m here to help you understand CVE-2026-13385. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70