Asus Router Bugs Let Neighbors Skip the Admin Password
Asus fixed three High-rated router flaws, including CVE-2026-93489 (CVSS 8.7), that let someone on your network act as admin without a password. No attacks reported yet.
Asus has pushed out router firmware fixing three flaws that could let someone on your network take over the router without a password, Notebookcheck reports. The bugs affect routers on the 3.0.0.6_102 firmware series, and Asus wants owners to update right away. Despite the “critical” in some headlines, Asus rates all three High, with scores up to 8.7. None has been reported as exploited.
For defenders
The bugs (Asus bulletin, Oct. 23; all CVSS v4.0):
- CVE-2026-93489, 8.7: improper authentication. An unauthenticated user on the adjacent network can forge an access ticket and perform admin operations.
- CVE-2026-75779, 8.6: command injection plus cross-site request forgery. If a logged-in admin visits a malicious website, commands can run as root on the router. This one is network-reachable but needs that user interaction.
- CVE-2026-75775, 7.7: command injection reachable from the adjacent network while the router is still in its factory-default state.
Notebookcheck’s article pins the “admin access without authentication” description on CVE-2026-75775; the CVE records give it to CVE-2026-93489, so we’ve followed the records. EPSS for CVE-2026-93489 is about 0.2%, no public exploit is reported, and none of the three are in CISA’s KEV catalog. Asus hasn’t published a model list or fixed build numbers; the records say only “3.0.0.6_102 series,” spelled two ways, so match both “3.0.0.6_102” and “3.0.0.6.102” in inventory. The finder credited for all three is researcher MrBruh.
These are separate from the two Asus router flaws fixed earlier this month (CVE-2026-14157 and CVE-2026-13313), which involved malicious VPN configuration files.
What it means for you
Your router is the box that connects every device in your home or office to the internet. Two of these bugs need the attacker to be on your network already, for example a neighbor on your Wi-Fi or a guest device. The third works if you click a bad link while logged in to the router’s settings page. An attacker who controls your router can snoop on or redirect your traffic, so it’s worth five minutes to update.
Do this now
- Log in to your Asus router (or the Asus Router app), check the firmware version, and install the latest update. Reboot afterward.
- Turn off remote admin access from the internet (WAN) if you don’t need it.
- Use a strong, unique admin password and Wi-Fi password, and put visitors on a guest network.
- Update before any factory reset or fresh setup, and don’t browse other sites while logged in to the router.
CVE at a glance
- CVSS
- 8.7 High (v4.0)
- EPSS
- 0.2% chance of exploitation in the next 30 days (higher than 13.8% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- None reported in public exploit databases
- CVSS
- 8.6 High (v4.0)
- EPSS
- 1.2% chance of exploitation in the next 30 days (higher than 68% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- None reported in public exploit databases
- CVSS
- 7.7 High (v4.0)
- EPSS
- 0.6% chance of exploitation in the next 30 days (higher than 48.6% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- None reported in public exploit databases
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.