The vulnerability involves OS command injection coupled with cross‑site request forgery that allows an attacker to trick a logged‑in administrator into visiting a malicious site, causing the router to execute arbitrary commands as root. This flaw maps to CWE‑78 (OS Command Injection) and CWE‑352 (Cross‑Site Request Forgery). The primary consequence is privileged command execution and full compromise of the router’s operating system, presenting a high‑severity risk to all devices running the affected firmware.

ASUS routers running firmware version 3.0.0.6.102 series are impacted. Users of this firmware should verify their build and apply any official updates released by ASUS.

The CVSS score of 8.6 indicates a high severity, and the EPSS score of 1% suggests a low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation likely requires that an attacker already has an authenticated session with the router’s administration interface, and succeeds in redirecting the legitimate administrator through a CSRF trick. Once the CSRF payload is delivered, the command injection flaw permits the attacker to execute arbitrary commands with root privileges.