A Cross‑Site Request Forgery flaw in the Web management interface allows an attacker to trigger privileged actions using an authenticated user’s session, resulting in the ability to execute system commands on the router. The flaw stems from a lack of proper request validation, thereby enabling unintended command execution. The consequences include compromise of confidentiality, integrity and availability of the device, and potentially full control of the router’s operating system.

The vulnerability affects ASUS router models running firmware that incorporates the vulnerable web interface. The advisory references the common platform enumeration cpe:2.3:o:asus:asus_firmware:*:*:*:*:*:*:*:*, but does not provide a specific firmware version range. All firmware builds containing the affected web management module are potentially at risk.

With a CVSS score of 8.5, this vulnerability is classified as high severity, while an EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog, further suggesting limited active exploitation. The attack vector is inferred to be CSRF; an attacker would need to trick an authenticated user into submitting a crafted web request or compromise the router’s network to gain privileged access. Successful exploitation would grant the attacker the same level of access as the user and could result in arbitrary command execution.