This vulnerability is a missing authentication flaw (CWE‑306) that allows an unauthenticated nearby user to issue HTTP requests to a specific critical function on certain ASUS routers. The attacker can receive device identification information and trigger a mode change in the router, and if the device enters an abnormal state it may lose its ability to self‑recover.

The affected products are ASUS routers running firmware version 3.0.0.4.388_series and related releases. Any router with this firmware family is potentially compromised.

The CVSS score of 5.3 indicates a moderate severity. The attack vector is likely local, requiring proximity or presence on the same local network. Because the EPSS score is not available and the issue is not listed in the CISA KEV catalog, the likelihood of widespread exploitation is uncertain, though the vulnerability could lead to information disclosure and a denial of service through forced mode changes.