CVE-2026-88710: OS Command Injection
Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an unauthenticated nearby user to trigger a chain of actions—unauthenticated queries, identifier guessing, credential overwriting, and command injection—resulting in the execution of arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require valid router credentials?
No. The issue can be exploited by an unauthenticated nearby user through a chain that includes unauthenticated queries and identifier guessing.
What level of access can an attacker obtain?
Successful exploitation can result in arbitrary command execution with root privileges on the affected router firmware.
Is remote Internet access sufficient to exploit this issue?
The available information describes the attacker as a nearby user. It does not state that exploitation is possible from the Internet.