CVE-2026-14157: Critical severity ASUS ASUS Router vulnerability
Published Oct 1, 2026
·Updated
Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface.
Affected Software
1 affected component
ASUS ASUS Router
Event History
Oct 1, 2026
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
DescriptionWeakness
Data Sourced
via NVD·02:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
An attacker must be authenticated to the router's web management interface. The issue is remotely exploitable once that access is available.
2
What attack path is identified?
The attacker uploads a crafted file through the web management interface. The externally controlled format string can then be used to execute arbitrary commands.
3
What is the potential impact of successful exploitation?
Successful exploitation allows arbitrary command execution on the affected router. The provided CVSS vector indicates high impact to confidentiality, integrity, and availability, including subsequent systems.