An OS command injection flaw exists in the web management interface of certain ASUS router models that allows a remote authenticated administrator to execute arbitrary system commands by supplying a specially crafted parameter. The vulnerability arises when user input is passed directly to the operating system shell without adequate sanitization. Successful exploitation enables the attacker to run commands with the privileges of the router’s administrative account, which can affect the device’s operation and configuration.

The issue affects ASUS router models running firmware that incorporates the vulnerable web interface. No specific firmware version range is provided in the advisory, so any firmware build containing the affected module could be susceptible.

The vulnerability carries a CVSS score of 8.6, indicating high severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring an authenticated administrative session; an attacker must first obtain or compromise router admin credentials to deliver a malicious request that triggers the OS command execution. Exploitation would grant the attacker the same level of access as the router’s administrator and could compromise the device’s security.