ASUS Patches Four High and Medium Flaws in Router Firmware
TL;DR
ASUS released an urgent security update for ASUS router firmware to fix four bugs in its remote file access tool. Tracked as CVE-2026-88707 through CVE-2026-88710, the flaws let attackers run root commands or crash the device. Owners must install the latest firmware build right away to protect their local networks.
[cve_glance_multi ids=”CVE-2026-88707, CVE-2026-88708, CVE-2026-88709, CVE-2026-88710″]
Why It Matters
ASUS routers manage home and office internet traffic for millions of users around the world. Because these four flaws sit in the remote file access service, a nearby or physical attacker can hijack the device. Even worse, the attacks need no login password.
Currently, neither ASUS nor MITRE reports any active attacks in the wild or public exploit code for these flaws. While exact affected device counts remain private, millions of homes and small firms run ASUS routers worldwide.
How the Attack Works
OS Command Injection via Network and USB
First, the worst bug is CVE-2026-88710 (CVSS 8.7), an OS command injection flaw (CWE-78). A nearby unauthenticated user can chain together queries, ID guessing, password overwrites, and command injection. Consequently, the attacker can run arbitrary commands on the router with full root rights.
Second, CVE-2026-88709 (CVSS 7.0) is another OS command injection bug (CWE-78) that requires physical access. If a user plugs in a USB drive with a crafted folder name, the router runs arbitrary commands as root.
Memory Overwrites and Service Crashes
Third, CVE-2026-88707 (CVSS 7.1) stems from an out-of-bounds write error (CWE-787). A nearby user can send an HTTP request with long parameters that pass the buffer limit. As a result, the request overwrites memory or crashes the system. Fourth, CVE-2026-88708 (CVSS 5.3) is an off-by-one flaw (CWE-193). A nearby attacker can send a packet with a specific header length to overwrite memory and crash the service.
Affected Versions
These four bugs affect ASUS router firmware across the 3.0.0.4.386, 3.0.0.4.388, and 3.0.0.6.102 release series.
Patch and Mitigation Steps
Owners should update their ASUS router firmware to the newest build right away through the ASUS Support portal. If users cannot patch now, they should turn off unused remote file access, cloud storage, and WAN admin features. Furthermore, admins should delete old file-sharing links and never plug in unknown USB drives. Finally, users should set a strong 10-character password for the admin page and WiFi network.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
