Security updates: Attackers can bypass login on Asus routers
Among other things, a critical security vulnerability endangers Asus routers. Malware can get onto devices.
(Image: Tatiana Popova/Shutterstock.com)
Eight software vulnerabilities threaten Asus routers. The descriptions of the vulnerabilities read as if attackers could gain full control over devices. In contrast, secured firmwares are available for download.
Which models are specifically affected is not clear from the security area of the Asus website. It only mentions "Asus router firmware" as vulnerable. This suggests that all Asus routers are impacted by the security vulnerabilities.
Starting points for attackers
The most dangerous is a "critical" vulnerability (CVE-2025-59366) in the AiCloud component. Due to a problem with Samba functionality, attackers can execute certain functions without the necessary permissions. Given the classification, it is assumed that devices are considered fully compromised after successful attacks.
Three further vulnerabilities (CVE-2025-59370, CVE-2025-59371, CVE-2025-12003) are classified as "high" threat. In these cases, for example, remote authenticated attackers can gain unauthorized access to devices. The Wi-Fi 7 models are reportedly not impacted by this. In another case, remote attackers can compromise the integrity of devices without logging in. What this means specifically is not clear from the description of the vulnerability.
The developers state that they have resolved the security issues in firmware versions 3.0.0.4_386 series, 3.0.0.4_388 series, and 3.0.0.6_102 series. Even though there are no indications of attacks so far, owners of Asus routers should update their devices promptly.
Videos by heise
A few days ago, the Asus developers closed a vulnerability in the MyAsus maintenance software.
(des)
