CVE-2026-14911: XSS
Published Oct 7, 2026
·Updated
Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
Affected Software
1 affected component
ASUS Router Firmware
Event History
Oct 7, 2026
CVE Published
via MITRE·02:13 AM
Data Sourced
via MITRE·02:13 AM
DescriptionWeakness
Data Sourced
via NVD·03:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What user interaction is required for exploitation?
An authenticated user must visit an attacker-crafted URL. The issue is described as being exploitable by a remote attacker; no attacker authentication requirement is stated.
2
Where can I find firmware-specific remediation information?
Consult the “Security Update for ASUS Router Firmware” section of the ASUS Security Advisory.