A flaw involving externally controlled format strings in ASUS Router module code allows an authenticated user to upload a specially crafted file via the web management interface. The uploaded data is incorporated into a format string operation, enabling the attacker to execute arbitrary system commands. This can lead to full compromise of the router, including firmware tampering, data exfiltration, and persistence of malicious software.

ASUS Router firmware 3.0.0.6_102 series. This version and potentially earlier firmware releases for the same series contain the vulnerable module handling of uploaded files.

The CVSS score of 9.4 categorizes this vulnerability as Critical, indicating high potential for system compromise. The attack requires remote authenticated access to the web interface, which is commonly exposed to the internet on many home routers. No exploit probability data is currently available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits yet. Nonetheless, the severity and required permissions make this a high‑risk threat that should be addressed promptly.