critical · CVSS v3 9.8 · CVSS v4 5.3 · EPSS 0.00189

CVE-2026-75753

Certain ASUS routers have a missing authentication flaw that allows an unauthenticated local user to send HTTP commands to retrieve device i

Overview

Certain ASUS routers have a missing authentication flaw that allows an unauthenticated local user to send HTTP commands to retrieve device information and change operation mode. This can cause the device to become unresponsive during abnormal conditions, impacting network availability. The vulnerability is critical and can affect network administrators and end users.

Description

Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to return device identification information and switch into a specific mode. As a result, when the router encounters abnormal conditions, it may be unable to perform self-recovery. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

Impact

Confidentiality: device identification information is exposed. Integrity: the router’s mode can be altered without authorization. Availability: the device may fail to self‑recover during abnormal conditions, disrupting network services. Network administrators and end users are directly impacted.

Remediation

Apply the latest firmware update released by ASUS. Disable remote HTTP management or restrict it to trusted IP ranges. Ensure the router’s LAN interface is protected by a firewall and monitor for anomalous HTTP requests.

Risk context

The CVSS v3 score of 9.8 marks this as a critical vulnerability, but the EPSS of 0.00189 indicates a low likelihood of exploitation. Nonetheless, defenders should patch promptly to mitigate potential local attacks.

Affected products

  • ASUS RT-AC68U
  • ASUS RT-AX86U
  • ASUS RT-AX56U
  • ASUS RT-AX3000

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
9.8
CVSS v4
5.3
EPSS
0.00189

authentication-bypass router network-security critical local-attack firmware-patch availability

← All CVEs

Related CVEs

critical

CVE-2026-113390

A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

View analysis

critical

CVE-2026-107400

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication.

View analysis

critical

CVE-2026-105298

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI (session.req_header().uri) saw the :authority value, but the upstream received the client-supplied Host value. Pingora also accepted :authority values containing userinfo (for example, [email protected]). This violates RFC 9113 Section 8.3.1, which requires an intermediary to use the :authority value for Host and replace any existing Host field. Root cause * HTTP/2 to HTTP/1.1: Host was generated from :authority only when the request had no Host header, so a conflicting client Host was forwarded unchanged. * HTTP/2 to HTTP/2: the client Host header was removed and used to overwrite the upstream :authority, after request filters had already run against the original :authority. * The HTTP/2 server did not compare Host with :authority and did not reject userinfo in the authority. Impact A remote, unauthenticated attacker can send a single HTTP/2 request that the application sees as one host and the upstream receives as another. Where request filters, access controls, or cache keys use the URI authority and the upstream routes by Host, this can lead to: * Cache poisoning: a response from another virtual host is stored under the victim host's cache key and served to other users (this also requires the upstream to serve different content per Host). * Host-based access control bypass: a request approved for one host is served by a different virtual host on the upstream. Deployments that do not accept HTTP/2 from clients, or that do not use the request authority for security or caching decisions, are not affected. Note that Cloudflare CDN customers were unaffected, as internal Pingora services at Cloudflare do not have HTTP/2 clients. Mitigation: * Upgrade to pingora 0.9.0 or later. Pingora now returns 400 Bad Request for HTTP/2 requests whose Host differs from :authority, that contain more than one Host, or whose authority contains userinfo, and keeps the upstream Host or :authority consistent with the request authority. Fix commits: https://github.com/cloudflare/pingora/commit/915590a91811877795531f6ba0927a3138b5cb4b , https://github.com/cloudflare/pingora/commit/ffab8302d08d4292d1924eb8fe84647fd5cb8e76 * If you cannot upgrade: in request_filter, reject HTTP/2 requests that carry a Host header different from the URI authority, or whose authority contains '@'.

View analysis

critical

CVE-2026-109395

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.

View analysis