ASUS Addresses Critical Router Vulnerability Allowing Remote Command Execution
Article Content
- •CVE-2026-13385 allows remote command execution on affected ASUS routers.
- •Multiple firmware versions are impacted, including widely used series.
- •ASUS has released patches and recommends immediate updates for users.
ASUS has issued critical security updates for a high-severity vulnerability in its router firmware, tracked as CVE-2026-13385, published on 2026-07-15. This flaw affects multiple firmware branches, including versions 3.0.0.4_386, 3.0.0.4_388, and 3.0.0.6_102. Attackers could exploit this vulnerability to execute arbitrary commands remotely, potentially through man-in-the-middle (MITM) attacks. The vulnerability poses significant risks to both enterprise and network security. ASUS has recommended that users update their firmware immediately to mitigate the threat. The issue is particularly concerning given the widespread use of the affected firmware versions. Security professionals are advised to monitor their networks for any signs of exploitation. The current status is that patches are available, and users are urged to apply them promptly.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Asus and CVE-2026-13385 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host… 
Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…