An OS command injection flaw in the web management interface of certain ASUS router models permits a remote authenticated administrator to execute arbitrary system commands by supplying a specially crafted parameter. The vulnerability arises because user input is passed directly to the operating system shell without adequate sanitization. Successful exploitation grants the attacker the privileges of the router’s administrative account, leading to full compromise of confidentiality, integrity, and availability of the device and potentially the broader network.

The vulnerability affects ASUS router models running firmware that incorporates the vulnerable web interface. The advisory does not specify a firmware version range. All firmware builds containing the affected web management module are potentially at risk.

With a CVSS score of 8.6, the vulnerability is classified as high severity, while an EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog, further suggesting limited active exploitation. The attack vector is inferred to be remote, requiring an authenticated administrative session; an attacker could log in to the web interface or otherwise obtain administrator credentials to submit a maliciously crafted request that triggers the OS command execution. Successful exploitation would grant the attacker the same level of access as the router’s administrator, potentially allowing arbitrary command execution and full control of the operating system.