CVE-2026-75779: OS Command Injection

Published Oct 23, 2026

Updated

Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing website, causing the router to execute arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

Affected Software

1 affected component

ASUS Router Firmware

Event History

Oct 23, 2026

CVE Published

via MITRE·07:03 AM

Data Sourced

via MITRE·07:03 AM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker must trick a logged-in router administrator into visiting a phishing website. The described attack relies on cross-site request forgery and does not state that the attacker needs direct authentication to the router.

What is the potential impact if exploitation succeeds?

Successful exploitation can cause the router to execute arbitrary operating-system commands with root privileges.

Which devices are affected?

The provided information identifies ASUS Router Firmware, but does not specify affected router models or firmware versions. Consult the ASUS Security Advisory referenced in the vulnerability information for product-specific scope.

CVE-2026-75779: OS Command Injection

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Which devices are affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Which devices are affected?