CVE-2026-75775: OS Command Injection

Published Oct 23, 2026

Updated

Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

Affected Software

1 affected component

ASUS Router Firmware

Event History

Oct 23, 2026

CVE Published

via MITRE·07:12 AM

Data Sourced

via MITRE·07:12 AM

DescriptionWeakness

Frequently Asked Questions

Are routers using the factory-default configuration exposed?

Yes. The issue can be exploited while an affected router is in its factory-default state.

What level of access does an attacker need?

A remote user can exploit the flaw by sending crafted parameters to the router. Successful exploitation allows arbitrary commands to run with root privileges.

What should administrators consult for remediation details?

Refer to the ASUS Security Advisory, specifically its “Security Update for ASUS Router Firmware” section, for affected firmware and update information.

CVE-2026-75775: OS Command Injection

Affected Software

Event History

Frequently Asked Questions

Are routers using the factory-default configuration exposed?

What level of access does an attacker need?

What should administrators consult for remediation details?

Company

Resources

Contact

Frequently Asked Questions

Are routers using the factory-default configuration exposed?

What level of access does an attacker need?

What should administrators consult for remediation details?