Vulnerability

CERT-In Vulnerability Note CIVN-2025-0342
Multiple Vulnerabilities in ASUS Router

Original Issue Date:November 26, 2025

Severity Rating: HIGH

Component Affected

ASUS Router

3.0.0.4_386 series
3.0.0.4_388 series
3.0.0.6_102 series

Overview

Multiple vulnerabilities have been reported in ASUS Router that could be exploited by an authenticated attacker to execute arbitrary code on the affected device.

Target Audience:
Network and Security Administrators, IT Operations and System Engineers, Enterprise Architects and CIOs/CTOs, Managed Service Providers (MSPs).

Risk Assessment:
There are high risks of Confidentiality, Operational, Integrity, and Availability.

Impact Assessment:
There are high risks of Confidentiality, Integrity, and Availability.

Description

1. Authentication-bypass Vulnerability ( CVE-2025-59366   CVE-2025-59371   )

These vulnerabilities exist in the AiCloud and IFTTT integration features due to an unintended side effect of the Samba functionality. An attacker could exploit these Vulnerabilities to execute specific functions without proper authorization, potentially gaining unauthorized access to the affected device.

2. SQL injection Vulnerability ( CVE-2025-59369   )

This vulnerability exists in the bwdpi component. A remote, authenticated attacker could exploit this Vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized access to sensitive data.

3. Command Injection Vulnerability ( CVE-2025-59368   CVE-2025-59370   )

These Vulnerabilities exist in AiCloud and bwdpi, an authenticated attacker could exploit these vulnerabilities by sending specially crafted requests, allowing the execution of arbitrary system commands and causing the device to run unintended instructions.

4. Path Traversal Vulnerability ( CVE-2025-59372   CVE-2025-12003   )

These Vulnerabilities exist in certain router models using WebDAV. A remote, authenticated attacker could exploit this vulnerability to write files outside the intended directory potentially compromising the devices file system.

Solution

Apply appropriate software updates as mentioned by vendor
https://www.asus.com/security-advisory

Vendor Information

ASUS
https://www.asus.com/security-advisory

References

https://www.asus.com/security-advisory

CVE Name
CVE-2025-59366
CVE-2025-59368
CVE-2025-59369
CVE-2025-59370
CVE-2025-59371
CVE-2025-59372
CVE-2025-12003

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India