Loading story…
STAR Labs disclosed two vulnerabilities in ASUSWRT version 3.0.0.4.384.20308 that exposed ASUS routers to remote attack. The more severe issue, tracked as CVE-2018-20334, was a command injection flaw in the web interface endpoint start_apply.htm, where crafted POST data supplied through the fb_email parameter could be used to execute commands on the device. A proof of concept showed an attacker starting telnetd, indicating the bug could enable full router compromise.
A second flaw, CVE-2018-20335, allowed an unauthenticated attacker to deny service by sending a crafted HTTP request with a malicious asus_token cookie, causing the router's httpd process to hang while handling the Cookie header in handle_request. ASUS was notified of both issues, acknowledged them, and released firmware updates to remediate the vulnerabilities; the vendor said the update also addressed CVE-2018-20336.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
ASUS published updated firmware to remediate the disclosed ASUSWRT vulnerabilities. The CVE-2018-20334 advisory states the fix was released on 2019-03-29, and the vendor confirmed the update also addressed CVE-2018-20336; CVE-2018-20335 was also described as patched via firmware update.
ASUS acknowledged the reported vulnerabilities after receiving STAR Labs' disclosure. The acknowledgment is explicitly noted for both CVE-2018-20334 and CVE-2018-20335.
STAR Labs disclosed multiple ASUSWRT flaws to ASUS, including CVE-2018-20334, a command injection issue in /start_apply.htm, and CVE-2018-20335, a denial-of-service flaw affecting the router's HTTP service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ASUS has released firmware and software updates for seven vulnerabilities across ASUSWRT routers and several Windows components, led by **CVE-2026-13385**, a critical router flaw rated **CVSS 9.5**. The issue affects CN SKU ASUS routers using the UU feature and, according to ASUS advisories, could let a machine-in-the-middle attacker spoof the update server and execute arbitrary commands without credentials; other reporting describes the bug as stemming from improper input validation in router management components and affecting firmware branches including `3.0.0.4_386`, `3.0.0.4_388`, and `3.0.0.6_102`. Successful exploitation could give attackers control of edge devices, enabling traffic interception, malware deployment, and broader network compromise. The broader advisory set also covers flaws in **ASUS System Control Interface v3**, **ASUS Business Manager**, **Aura Wallpaper Service**, **GameSDK**, and router web interfaces, with impacts including physical memory access, information disclosure, denial of service, unauthorized file operations, credential exposure, and data tampering. ASUS said none of the vulnerabilities are confirmed to be under active exploitation and that no public proof-of-concept is known for the critical router issue, but urged customers to apply updates immediately, disable remote administration or affected router features if patching is delayed, restrict management access to trusted IP ranges, use strong credentials, and replace end-of-life routers no longer supported after March 2026.
Jul 22, 2026
ASUS has released security advisories addressing several critical vulnerabilities affecting its routers and PC software. Notably, CVE-2025-59366 is an authentication bypass flaw in the AiCloud feature of ASUS routers, with a CVSS score of 9.4, allowing attackers to execute specific functions without proper authorization due to a Samba-related issue. Additionally, CVE-2025-12003 is a path traversal vulnerability in the WebDAV component of ASUS router firmware, enabling unauthenticated remote attackers to compromise device integrity. Another high-severity issue, CVE-2025-59373, impacts the ASUS System Control Interface Service used by the MyASUS application, allowing local privilege escalation to SYSTEM on Windows devices through a flawed file-restore mechanism. ASUS has provided patches for these vulnerabilities and urges users to update affected devices immediately. The vulnerabilities impact a wide range of ASUS products, including desktop PCs, laptops, NUC systems, All-in-One machines, and various router models. Attackers exploiting these flaws could gain unauthorized access, escalate privileges, or execute arbitrary code, posing significant risks to both home and enterprise environments. Users are advised to verify their device firmware and software versions and apply the latest security updates via Windows Update or the ASUS Support site to mitigate these threats.
Jun 29, 2026
ASUS has released new firmware updates to address nine security vulnerabilities in its routers, including a critical authentication bypass flaw identified as CVE-2025-59366. This vulnerability affects routers with the AiCloud feature enabled, which allows remote access and personal cloud functionality. The flaw, stemming from an unintended side effect of the Samba functionality, could allow remote attackers to execute specific functions without proper authorization by chaining path traversal and OS command injection weaknesses. ASUS strongly urges all users to update their router firmware immediately to mitigate these risks. For users with end-of-life ASUS router models that will not receive firmware updates, the company recommends disabling all internet-facing services such as AiCloud, WAN remote access, port forwarding, DDNS, VPN server, DMZ, port triggering, and FTP. Additionally, users are advised to use strong, unique passwords for both router login and WiFi to reduce exposure. The vulnerabilities have made outdated ASUS routers attractive targets for botnet campaigns, emphasizing the importance of prompt mitigation and firmware updates to protect against exploitation.
Jun 29, 2026