CVE-2025-59365: ASUS Router Stack Buffer Overflow Vulnerability

CVE-2025-59365 Overview

CVE-2025-59365 is a stack buffer overflow vulnerability [CWE-121] affecting certain ASUS router models. An authenticated attacker can trigger the flaw by sending a crafted request to the device. Successful exploitation impacts device availability, resulting in a denial-of-service condition on affected routers. ASUS documents the issue in the Security Update for ASUS Router Firmware section of its security advisory portal. The vulnerability requires network access and high privileges, but no user interaction. Because routers sit at the network perimeter, an outage on these devices disrupts connectivity for all downstream clients.

Critical Impact
Authenticated attackers can crash affected ASUS routers by sending a malformed request, disrupting network connectivity for all downstream users.

Affected Products

ASUS Router Firmware (specific models identified in the ASUS Security Advisory)
See the ASUS Security Advisory for the authoritative list of affected models and firmware versions

Discovery Timeline

2025-11-25 - CVE-2025-59365 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59365

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow [CWE-121] in the request handling logic of ASUS router firmware. When the router parses attacker-supplied input from an authenticated session, it writes data beyond the bounds of a fixed-size stack buffer. This corrupts adjacent stack memory, including saved return addresses and local variables. The result is process termination or device reboot, producing a denial of service. The advisory scopes impact to availability only; confidentiality and integrity are not affected according to the published CVSS vector. The attacker must already hold administrative or high-privilege credentials on the router management interface to reach the vulnerable code path.

Root Cause

The root cause is missing or insufficient bounds checking when copying attacker-controlled data into a stack buffer during request processing. ASUS has not published the specific function or parameter involved. Refer to the ASUS Security Advisory for firmware-level technical details.

Attack Vector

Exploitation requires network reachability to the router administrative interface and valid high-privilege credentials. The attacker submits a crafted HTTP request containing an oversized field to the vulnerable endpoint. No user interaction is required. Because the impact is confined to availability, the practical outcome is a device crash or forced reboot rather than remote code execution. The Exploit Prediction Scoring System (EPSS) currently indicates a low near-term likelihood of active exploitation.

// No verified proof-of-concept code is publicly available.
// Refer to the ASUS Security Advisory for firmware-level details.

Detection Methods for CVE-2025-59365

Indicators of Compromise

Unexpected reboots or crashes of ASUS routers coinciding with administrative HTTP requests
Authenticated sessions to the router management interface originating from unusual source addresses
Malformed or oversized HTTP request bodies directed at router administrative endpoints
Gaps in router syslog output followed by service restart messages

Detection Strategies

Forward router syslog and crash telemetry to a centralized logging platform for correlation
Alert on repeated router reboots within short time windows, particularly following administrative logins
Inspect HTTP request sizes to router management interfaces and flag requests with anomalously large parameters
Monitor administrative login events for successful authentication from unexpected geographies or hosts

Monitoring Recommendations

Ingest router logs into a centralized data lake or SIEM to preserve evidence across reboots
Track baseline router uptime and alert on statistically significant availability drops
Correlate authenticated administrative sessions with subsequent device instability events

How to Mitigate CVE-2025-59365

Immediate Actions Required

Apply the firmware update published in the ASUS Security Advisory for affected router models
Restrict router administrative access to trusted management networks only
Rotate administrative credentials on affected routers and enforce strong, unique passwords
Disable remote WAN-side administration unless explicitly required

Patch Information

ASUS has released firmware updates addressing this vulnerability. Consult the Security Update for ASUS Router Firmware section of the ASUS Security Advisory for the specific firmware version applicable to each router model and download links.

Workarounds

Block access to the router administrative interface from untrusted network segments using ACLs or firewall rules
Require VPN access before permitting connections to the router management interface
Enforce multi-factor authentication where supported by the router firmware
Monitor for and rate-limit repeated authentication attempts against the administrative interface

bash

# Example: restrict router admin interface to a trusted management subnet
# (adjust interface names and subnet to match your environment)
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP