ASUS vulnerabilities
We track 116 vulnerabilities in ASUS products across 60+ products. 116 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest ASUS vulnerabilities
- 9.2 Critical severity
Router: Improper Limitation of a Pathname to a Restricted Directory
An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba functionality, potentially leading to allow execution of specific functions without proper authorization. Refer to the Secur
- 8.2 High severity
Router: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability has been identified in WebDAV, which may allow unauthenticated remote attackers to impact the integrity of the device. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more inform
- 8.5 High severity
MyASUS: Incorrect Permission Assignment for Critical Resource
A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when an unprivileged actor copies files without proper validation into protected system paths, potentially leading to arbitrary fil
- 9.8 Critical severity
DSL-AC51: Missing Authentication for Critical Functionality
An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized access into the affected system. Refer to the 'Security Update for DSL Series Router' section on the ASUS Security Advisor
- 7.3 High severity
Armoury Crate: Improper Restriction of Operations within the Bounds of a Memory Buffer
A improper restriction of operations within the bounds of a memory buffer exists in AsIO3.sys driver. This vulnerability can be triggered by manually executing a specially crafted process, potentially leading to local privilage escalation. For additional infor
- 8.5 High severity
Armoury Crate: Improper Link Resolution Before File Access
A link following vulnerability exists in the UnifyScanner component of Armoury Crate. This vulnerability may be triggered by creating a specially crafted junction, potentially leading to local privilege escalation. For more information, please refer to section
- 7.7 High severity
MyASUS: Use of Hard-coded Credentials
An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services. Refer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory
- 8.4 High severity
Armoury Crate: Time-of-check Time-of-use (TOCTOU) Race Condition
A race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issue, potentially leading to authentication bypass. Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory f
- 8.2 High severity
Armoury Crate: Stack-based Buffer Overflow
A stack buffer overflow has been identified in the AsIO3.sys driver. This vulnerability can be triggered by input manipulation, may leading to a system crash (BSOD) or other potentially undefined execution. Refer to the 'Security Update for Armoury Crate App'
- 9.4 Critical severity
DriverHub: Improper Certificate Validation
"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulnerability in ASUS DriverHub may allow untrusted sources to affect system behavior via crafted HTTP requests. Refer to the
- 8.4 High severity
DriverHub: Origin Validation Error
"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in ASUS DriverHub may allow unauthorized sources to interact with the software's features via crafted HTTP requests. Refer to
- 9.2 Critical severity
Router: Authentication Bypass Using an Alternate Path or Channel
An improper authentication control vulnerability exists in AiCloud. This vulnerability can be triggered by a crafted request, potentially leading to unauthorized execution of functions. Refer to the 'ASUS Router AiCloud vulnerability' section on the ASUS Secur
- 8.4 High severity
Armoury Crate: Missing Authentication for Critical Functionality
A file handling command vulnerability in certain versions of Armoury Crate may result in arbitrary file deletion. Refer to the '01/23/2025 Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.
- 7.2 High severity
Router: Improper Neutralization of Special Elements used in a Command
An unintended entry point vulnerability has been identified in certain router models, which may allow for arbitrary command execution. Refer to the ' 01/02/2025 ASUS Router AiCloud vulnerability' section on the ASUS Security Advisory for more information.
- 7.2 High severity
An improper input insertion vulnerability in AiCloud on certain router models may lead to…
An improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution. Refer to the '01/02/2025 ASUS Router AiCloud vulnerability' section on the ASUS Security Advisory for more information.
- 9.8 Critical severity
rt-ax88u_firmware: Buffer Copy without Checking Size of Input
Buffer Overflow vulnerability in ASUS router RT-AX88U with firmware versions v3.0.0.4.388_24198 allows a remote attacker to execute arbitrary code via the connection_state_machine due to improper length validation for the cookie field.
- 9.8 Critical severity
DSL-N17U: Unrestricted Upload of File with Dangerous Type
Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands on the device.
- 7.2 High severity
Download Master: Stack-based Buffer Overflow
ASUS Download Master has a buffer overflow vulnerability. An unauthenticated remote attacker with administrative privileges can exploit this vulnerability to execute arbitrary system commands on the device.
- 7.2 High severity
Download Master: Improper Neutralization of Special Elements used in an OS Command
The specific function parameter of ASUS Download Master does not properly filter user input. An unauthenticated remote attacker with administrative privileges can exploit this vulnerability to execute arbitrary system commands on the device.
- 7.2 High severity
Download Master: Unrestricted Upload of File with Dangerous Type
The upload functionality of ASUS Download Master does not properly filter user input. Remote attackers with administrative privilege can exploit this vulnerability to upload any file to any location. They may even upload malicious web page files to the website
- 7.2 High severity
ZenWiFi XT8: Stack-based Buffer Overflow
Certain models of ASUS routers have buffer overflow vulnerabilities, allowing remote attackers with administrative privileges to execute arbitrary commands on the device.
- 8.8 High severity
gputweak_ii: Improper Privilege Management
An issue in the component IOMap64.sys of ASUSTeK Computer Inc ASUS GPU TweakII v1.4.5.2 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.
- 8.4 High severity
atszio_driver: Exposed IOCTL with Insufficient Access Control
An issue in the component ATSZIO64.sys of ASUSTeK Computer Inc ASUS ATSZIO Driver v0.2.1.7 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.
- 7.8 High severity
bios_flash_driver: Exposed IOCTL with Insufficient Access Control
An issue in the component AsusBSItf.sys of ASUSTeK Computer Inc ASUS BIOS Flash Driver v3.2.12.0 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.
- 8.8 High severity
aisuite3: Exposed IOCTL with Insufficient Access Control
An issue in the component AslO3_64.sys of ASUSTeK Computer Inc AISuite3 v3.03.36 3.03.36 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.
- 7.8 High severity
sabertooth_x99_driver: Exposed IOCTL with Insufficient Access Control
An issue in the component AsIO64.sys of ASUSTeK Computer Inc ASUS SABERTOOTH X99 Driver v1.0.1.0 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.
- 7.8 High severity
usb3.0_boost_storage_driver: Exposed IOCTL with Insufficient Access Control
An issue in the component AsUpIO64.sys of ASUSTeK Computer Inc ASUS USB 3.0 Boost Storage Driver 5.30.20.0 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.
- 7.2 High severity
ExpertWiFi: Improper Neutralization of Special Elements used in an OS Command
ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS Expe
- 9.8 Critical severity
fan_xpert: Exposed IOCTL with Insufficient Access Control
An issue discovered in the DeviceIoControl component in ASUS Fan_Xpert before v.10013 allows an attacker to execute arbitrary code via crafted IOCTL requests.
- 8.4 High severity
rt-n12\+_b1: Cleartext Storage of Sensitive Information
Asus RT-N12+ B1 router stores user passwords in plaintext, which could allow local attackers to obtain unauthorized access and modify router settings.
- 8.8 High severity
ExpertWiFi EBM63: Improper Neutralization of Special Elements used in an OS Command
Certain ASUS WiFi routers models has an OS Command Injection vulnerability, allowing an authenticated remote attacker to execute arbitrary system commands by sending a specially crafted request.
- 9.8 Critical severity
Armoury Crate: Missing Authentication for Critical Functionality
ASUS Armoury Crate has a vulnerability in arbitrary file write and allows remote attackers to access or modify arbitrary files by sending specific HTTP requests without permission.
- 8.8 High severity
RT-AX55: Improper Neutralization of Special Elements used in an OS Command
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its code-authentication module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to e
- 8.8 High severity
RT-AX55: Improper Neutralization of Special Elements used in an OS Command
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its check token module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute a
- 8.8 High severity
RT-AX55: Improper Neutralization of Special Elements used in an OS Command
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute
- 8.8 High severity
RT-AX55: Improper Neutralization of Special Elements used in an OS Command
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execu
- 8.8 High severity
RT-AX88U: Use of Externally-Controlled Format String
ASUS router RT-AX88U has a vulnerability of using externally controllable format strings within its Advanced Open VPN function. An authenticated remote attacker can exploit the exported OpenVPN configuration to execute an externally-controlled format string at
- 8.8 High severity
ASUS RT-AX55 Routers OS Command Injection Exploited
On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar "token-generated module" issue, see CVE-2023-41345; for the similar "token-refresh mod
- 7.2 High severity
RT-AX55: Use of Externally-Controlled Format String
It is identified a format string vulnerability in ASUS RT-AX56U V2’s iperf client function API. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_cli.cgi module. A remote attacker with administrator privilege can exp
- 7.2 High severity
RT-AX55: Use of Externally-Controlled Format String
It is identified a format string vulnerability in ASUS RT-AX56U V2’s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. A remote attacker with administrator privilege can exploit this vuln