The vulnerability is a stack-based buffer overflow that occurs when the router processes a specially crafted device name. An unauthenticated attacker in close proximity can trigger the overflow, leading to execution of arbitrary commands with root privileges on the router’s operating system.

Affected products are ASUS routers running firmware versions from the ASUSWRT 3.0.0.4 series for the 386 and 388 hardware series and the ASUSWRT 3.0.0.6 102 series. These firmware releases are listed in the advisory and should be identified by their CPE strings.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attacker must be physically close or have local network access to the router. The attack requires an unauthenticated attacker to have network or physical proximity to the router, and the exploit relies on sending a maliciously crafted device name string. Because the flaw grants root privileges, a successful exploit would provide full control over the device and potentially allow the attacker to exfiltrate network traffic, modify network policies, or use the router as a foothold for further attacks.