Description
A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and read or modify router settings via observed values from an administrator-initiated IFTTT pairing session.Refer to the ' Security Update for ASUS Router Firmware  ' section on the ASUS Security Advisory for more information.
Published: 2026-10-07
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated access to router configuration via predictable pairing token
Action: Immediate Patch
AI Analysis

Impact

A predictable seed in the router's pseudo‑random number generator used for IFTTT pairing creates a token that can be derived by anyone observing a pairing session. This flaw allows an unauthenticated user to obtain the pairing token and use it to view or alter the router’s settings, effectively bypassing authentication controls and compromising the device’s integrity.

Affected Systems

ASUS routers running firmware version 3.0.0.6_102_series, including models such as the RT‑BE57, are susceptible. The vulnerability is disclosed for the IFTTT pairing feature in this firmware revision.

Risk and Exploitability

The CVSS score of 7.7 classifies the vulnerability as high severity. No EPSS data is available, but the flaw permits local attacks with no privilege requirements. It is not currently listed in CISA’s KEV catalog. An attacker in proximity to the router can observe an administrator-initiated pairing session and reproduce the token to gain control, potentially leading to unauthorized configuration changes or persistence.

Generated by OpenCVE AI on October 7, 2026 at 03:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the router to the latest firmware version released by ASUS that addresses the PRNG seed issue
  • If possible, disable the IFTTT pairing feature or restrict its use to trusted devices
  • Change the router's administrative password to a strong, unique value after updating the firmware

Generated by OpenCVE AI on October 7, 2026 at 03:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://www.asus.com/security-advisory cve-icon cve-icon
History

Wed, 07 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 04:00:00 +0000

Type Values Removed Values Added
Title Predictable PRNG Seed Enables Unauthenticated Control of ASUS Router Settings

Wed, 07 Oct 2026 02:15:00 +0000

Type Values Removed Values Added
Description A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and read or modify router settings via observed values from an administrator-initiated IFTTT pairing session.Refer to the ' Security Update for ASUS Router Firmware  ' section on the ASUS Security Advisory for more information.
First Time appeared Asus
Asus router
Weaknesses CWE-337
CPEs cpe:2.3:a:asus:router:3.0.0.6_102_series:*:*:*:*:*:*:*
Vendors & Products Asus
Asus router
References
Metrics cvssV4_0

{'score': 7.7, 'vector': 'CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Asus Router
cve-icon MITRE

Status: PUBLISHED

Assigner: ASUS

Published:

Updated: 2026-10-07T18:38:56.073Z

Reserved: 2026-08-10T07:25:54.054Z

Link: CVE-2026-19396

cve-icon Vulnrichment

Updated: 2026-10-07T18:38:42.931Z

cve-icon NVD

Status : Deferred

Published: 2026-10-07T02:16:58.013

Modified: 2026-10-07T19:17:36.380

Link: CVE-2026-19396

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T05:30:12Z

Weaknesses
  • CWE-337

    Predictable Seed in Pseudo-Random Number Generator (PRNG)