Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, thereby enabling the attacker to perform arbitrary administrator operations. The vulnerability, identified as CWE‑287, effectively bypasses normal authentication controls, allowing local users to gain privileged control over the router. Consequences include unauthorized configuration changes, potential network disruption, and compromise of connected devices.

ASUS routers running firmware identified by the CPE cpe:2.3:a:asus:router:3.0.0.6_102_series, which includes the 3.0.0.6_102 series firmware. Only ASUS routers are affected according to the advisory; no other vendors or products were mentioned.

With a CVSS score of 8.7 the vulnerability is classified as high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, so the exact likelihood of exploitation is uncertain. However, the description indicates that the attack vector is local; an attacker must be able to issue an HTTP request to the router from a nearby network. Because authentication is circumvented, no credentials are required. If the router is exposed to untrusted networks, the risk is elevated. Immediate patching effectively removes the vulnerability.