CVE-2026-88709: OS Command Injection
Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an user with physical access to insert a USB device containing a specially crafted directory name, potentially executing arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Devices running affected ASUS Router firmware are exposed when an attacker can physically access the router and insert a USB device. Remote-only attackers are not described as able to exploit this issue.
What does an attacker need to exploit it?
The attacker needs physical access to the router and a USB device containing a specially crafted directory name. Successful exploitation may allow arbitrary commands to run with root privileges.
What can be done if firmware updates cannot be applied immediately?
Restrict physical access to the router and prevent untrusted USB devices from being inserted. The provided information does not specify another mitigation.