An Active Debug Code vulnerability in ASUS routers allows a remote authenticated user to craft an HTTP request that bypasses security checks and enables the Telnet service. This flaw enables execution of arbitrary commands with root privileges, allowing the attacker to fully control the router and potentially reach devices that share the same network. The issue is categorized as CWE‑489, highlighting improper handling of inputs that can lead to privilege escalation.

The vulnerability affects ASUS router firmware versions 3.0.0.4_386_series, 3.0.0.4_388_series, and 3.0.0.6_102_series. All routers running these firmware builds expose the vulnerability.

The CVSS score is 8.9, indicating high severity. EPSS is not available, so current exploitation probability is unknown. The vulnerability is not listed in CISA KEV. The attack vector is remote and requires authenticated access but can be achieved via a crafted HTTP request. Successful exploitation gives the attacker root-level control over the router, potentially compromising network traffic and connected devices.