The vulnerability is an OS command injection (CWE-78) that allows a remote attacker to execute arbitrary commands with root privileges on affected ASUS routers. A crafted parameter string supplied to the router's management interface when the device remains in factory‑default configuration can trigger this flaw. The attacker could use this to compromise the entire device, exfiltrate data, or pivot to connected networks.

ASUS routers running firmware series 3.0.0.6.102 and related models are impacted. Any device with the default factory configuration that still uses the vulnerable firmware is susceptible.

A CVSS score of 7.7 classifies the flaw as high severity, indicating substantial risk to confidentiality, integrity, and availability. EPSS data is unavailable, and the vulnerability is not currently listed in the CISA KEV catalog, implying no confirmed exploits yet. The vulnerability can be exploited remotely by submitting malicious parameters to the router's exposed interface—likely through the web management console—while the device remains unconfigured from its factory state. Mitigation requires applying the official firmware update.