Asus Releases security updates to fix two severe vulnerabilities in its routers, addressing issues that could allow attackers to execute commands remotely and enable root access via debug code, amid concerns over recurring configuration-based attacks.
Asus has patched two serious router vulnerabilities that could let an attacker run commands on affected devices, including one flaw triggered by a malicious VPN client configuration file uploaded through the web management interface. The company says the issue can affect users who import VPN settings directly into the router, rather than people using VPN apps on a computer or phone.
The more severe bug, tracked as CVE-2026-14157, carries a CVSS score of 9.4 out of 10. According to Asus’s advisory and the CVE record, a crafted VPN configuration file can be interpreted in a way that leads to arbitrary command execution. Asus said users should only import VPN client configuration files from trusted sources.
A second flaw, CVE-2026-13313, scores 8.9 and stems from debug code left enabled. Asus says an authenticated attacker could bypass security checks, switch on Telnet and potentially run commands with root privileges. The company recommends using a strong, unique administrator password and avoiding scripts, tools or commands from untrusted sources on any device within the local network.
Tom’s Hardware reported that the router bug follows a similar weakness disclosed in 2024, suggesting that configuration-file imports through Asus’s web interface remain a recurring attack surface. The outlet also noted that Asus has patched a separate issue affecting 13 motherboards, where a physically present attacker could read or write arbitrary system memory by inserting a specially crafted device.
Users are being directed to install the latest firmware from Asus’s support pages or product pages. For routers that have reached end of life, Asus said no new firmware will be issued, leaving strong passwords and careful handling of network credentials as the main mitigations.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
