Based on the description, it is inferred that the buffer copy does not check the input size, allowing an authenticated adjacent user to overflow an HTTP request parameter. This corrupts device memory and brings the router down, classifying the incident as denial of service because the attacker can crash the router without affecting data confidentiality or integrity. The vulnerability is identified as CWE‑121.

Vulnerable routers include ASUS routers that run Asuswrt firmware version 3.0.0.4, specifically those in the 386 and 388 hardware series. Based on the description, it is inferred that the attack surface is limited to authenticated users who can send HTTP requests to the management interface. The likely attack vector is an authenticated HTTP request with an oversized input that triggers the buffer overflow.

The static evaluation gives a CVSS score of 8.2, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector involves an authenticated local user sending oversized data over the HTTP interface, suggesting the exploitation is easier than a fully remote, unauthenticated attack but still requires privileged knowledge. Consequently, the risk is high and the likelihood of exploitation remains uncertain but potentially realistic in environments where management traffic is exposed or credentials are weak.