The vulnerability is a cross‑site scripting flaw in several ASUS router modules that allows a remote attacker to trigger when an authenticated user visits a crafted URL. By injecting arbitrary scripts into the router’s web interface the attacker can read the user’s session context, modify router configuration, and potentially cause a denial of service. This results in unauthorized manipulation of the device’s behavior and loss of network connectivity for legitimate users.

Affected devices are ASUS routers that run firmware version 3.0.0.6.102 series, as identified by the corresponding CPE string. No other specific versions are listed.

The flaw carries a CVSS score of 9.3, indicating high severity. While EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, the ability to alter router settings and cause a DoS provides a significant impact on confidentiality, integrity, and availability. The likely attack path is a remote attacker sending a crafted URL that an authenticated user later opens within the router’s web interface. Successful exploitation requires an authenticated session, making the threat vector more constrained but still operational if attackers compromise owner credentials or intercept network traffic.