CVE-2025-15101

8.6 highEPSS 0.9%

High (8.6) in asus asus firmware. EPSS 0.9% chance of exploitation in the next 30 days.

An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrators to execute arbitrary system commands via a crafted parameter. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

Severity

CVSS 4.0

8.6 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2026-03-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

asus:asus_firmware

References

https://www.asus.com/security-advisory/

Check your stack JSON