Critical ASUS Router Flaw Lets Remote MITM Attackers Execute Arbitrary Commands

ASUS has patched a critical router vulnerability, tracked as CVE-2026-13385, that allows remote man‑in‑the‑middle (MITM) attackers to force affected devices to download and execute arbitrary commands via a spoofed server.

This flaw directly impacts the integrity of firmware‑level operations on perimeter networking devices widely deployed in home and small‑office environments.

The vulnerability resides in the UU feature of ASUSWRT firmware used on specific CN‑SKU router models, where routers contact an upstream service without sufficiently validating the authenticity and integrity of the response.

Critical ASUS Router Flaw

A remote MITM adversary on the network path can intercept or redirect this traffic, impersonate the legitimate ASUS service, and return attacker‑controlled content that the router trusts and executes.

Once exploited, CVE-2026-13385 enables the attacker to run arbitrary commands on the router, opening the door to full configuration tampering, DNS and traffic redirection, persistent malware installation, and use of the compromised router as a launchpad for further attacks into internal networks.

Because routers sit at the network edge, compromise of a single device can undermine the confidentiality and integrity of all systems routed through it, including VPN traffic, cloud access, and administrative interfaces.

This makes the flaw particularly dangerous for organizations that rely on consumer‑grade devices in branch offices or remote‑work setups.

ASUS’s July 15, 2026 advisory lists affected firmware branches as the 3.0.0.4_386, 3.0.0.4_388, and 3.0.0.6_102 series for CN‑SKU router models, all grouped under “Security Update for ASUS Router Firmware.”

The same advisory batch also includes CVE-2026-11851, an information‑disclosure issue in router firmware, and CVE-2026-12960 affecting the ASUS Router Android app, highlighting a broader ecosystem hardening across network and management components.

ASUS publishes these issues on a consolidated security advisory page, requiring administrators to search by CVE ID or product family to locate relevant entries.

At the time of disclosure, ASUS reported no known in‑the‑wild exploitation and no publicly available proof‑of‑concept for CVE-2026-13385, but urged customers to patch immediately due to the critical rating and remote exploitation potential.

Mitigation

Administrators should update all affected routers to the latest fixed firmware and verify that devices are no longer running the impacted 3.0.0.4_386, 3.0.0.4_388, or 3.0.0.6_102 builds.

Organizations should also reinforce upstream network security to reduce MITM opportunities, monitor routers for anomalous traffic or unexpected reboots, and segment critical internal assets away from untrusted or legacy edge devices.

Given the concurrent driver, utility, and app advisories, treating this as a coordinated portfolio‑wide patch cycle will help minimize overall attack surface across ASUS‑based environments.

Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.