Description
Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intended buffer or potentially cause a denial-of-service (DoS) via a crafted packet.
Refer to the ' 
Security Update for ASUS Router Firmware  ' section on the ASUS Security Advisory for more information.
Published: 2026-11-04
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

An out-of-bounds write flaw (CWE-787) exists in certain ASUS Router firmware versions. A crafted network packet can cause the firmware to write beyond a designated buffer, potentially corrupting memory or triggering a crash. The vulnerability does not require authentication and could be used by a nearby attacker to disrupt the router’s operation.

Affected Systems

The flaw affects ASUS Router firmware releases ASUSTWRT 3.0.0.4_386 and 3.0.0.4_388, as well as ASUSTWRT 3.0.0.6_102 series. Any router running these firmware versions is vulnerable.

Risk and Exploitability

The CVSS score of 7.2 reflects moderate to high risk, while no EPSS score is available. The issue is not currently listed in the CISA KEV catalog. Because the vulnerability can be triggered by an unauthenticated attacker sending a specially crafted packet, the attack vector is likely local network or nearby wireless clients. Exploitation is straightforward for a knowledgeable attacker, making the risk significant for exposed routers.

Generated by OpenCVE AI on November 4, 2026 at 10:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the router to the latest ASUS firmware that contains the patch for the out-of-bounds write flaw.
  • If an update cannot be applied immediately, block or limit inbound traffic on the interface that processes the vulnerable packets, or disable the related services temporarily.
  • Enable detailed logging on the router and monitor for anomalous packets, and consider isolating the device from the internal network until a secure firmware version is installed.

Generated by OpenCVE AI on November 4, 2026 at 10:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://www.asus.com/security-advisory cve-icon cve-icon
History

Wed, 04 Nov 2026 11:15:00 +0000

Type Values Removed Values Added
Title Buffer Overflow in ASUS Router Firmware Causes Denial of Service

Wed, 04 Nov 2026 02:15:00 +0000

Type Values Removed Values Added
Description Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intended buffer or potentially cause a denial-of-service (DoS) via a crafted packet. Refer to the '  Security Update for ASUS Router Firmware  ' section on the ASUS Security Advisory for more information.
First Time appeared Asus
Asus router Firmware
Weaknesses CWE-787
CPEs cpe:2.3:a:asus:router_firmware:asuswrt_3.0.0.4_386_series:*:*:*:*:*:*:*
cpe:2.3:a:asus:router_firmware:asuswrt_3.0.0.4_388_series:*:*:*:*:*:*:*
cpe:2.3:a:asus:router_firmware:asuswrt_3.0.0.6_102_series:*:*:*:*:*:*:*
Vendors & Products Asus
Asus router Firmware
References
Metrics cvssV4_0

{'score': 7.2, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Asus Router Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: ASUS

Published:

Updated: 2026-11-04T02:03:00.932Z

Reserved: 2026-09-02T06:17:47.147Z

Link: CVE-2026-84729

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-04T02:17:21.163

Modified: 2026-11-04T02:17:21.163

Link: CVE-2026-84729

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T10:30:10Z

Weaknesses