CVE-2026-12960: ASUS Router App Intent Vulnerability

CVE-2026-12960 Overview

CVE-2026-12960 is an Improper Export of Android Application Components vulnerability [CWE-926] affecting the ASUS Router Android application. A third-party application installed on the same device can send a crafted Android Intent to an exported component of the ASUS Router App. The crafted Intent causes the ASUS Router App to open a URL specified by the malicious app. The flaw requires local access and user interaction, and it does not directly compromise the confidentiality, integrity, or availability of the ASUS Router App itself. However, it can be abused to redirect users toward attacker-controlled web content, enabling phishing or social engineering attacks against router administrators.

Critical Impact
A co-resident malicious Android app can force the ASUS Router App to load an attacker-specified URL, providing a launchpad for phishing against router credentials.

Affected Products

ASUS Router App for Android (see ASUS Security Advisory for specific versions)
Android devices with the ASUS Router App installed alongside untrusted third-party applications
Home and small-office deployments using the ASUS Router App for device management

Discovery Timeline

2026-07-03 - CVE-2026-12960 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-12960

Vulnerability Analysis

The ASUS Router App exposes one or more Android application components (such as an Activity, Service, or BroadcastReceiver) with android:exported="true" without adequate access controls. Any other application on the same device can craft an Intent that targets the exposed component and passes a URL parameter. The ASUS Router App then processes the Intent and opens the supplied URL, effectively acting as an open redirect proxy for the local malicious app. The issue is classified as CWE-926: Improper Export of Android Application Components. Because the redirection occurs inside a trusted router-management application, users are more likely to trust the resulting page and submit sensitive credentials.

Root Cause

The root cause is a missing or insufficient permission check on an exported component that accepts URL data from arbitrary Intent senders. The component should either be marked non-exported, restricted with a signature-level permission, or should validate the caller and sanitize the URL scheme, host, and path before rendering.

Attack Vector

An attacker must first place a low-privilege application on the target device through side-loading, a malicious app store listing, or a bundled installer. That application constructs an Intent referencing the exported ASUS Router App component and includes a URL pointing to attacker-controlled infrastructure. The victim then interacts with the resulting screen, satisfying the user-interaction requirement. Exploitation is limited to the local device and does not traverse the network.

No verified public proof-of-concept code is available. See the ASUS Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-12960

Indicators of Compromise

Unexpected browser or in-app WebView launches originating from the ASUS Router App after installing a new third-party application
Presence of unknown or side-loaded Android packages that declare Intents targeting ASUS Router App components
Phishing pages mimicking ASUS or router login flows appearing shortly after opening an unrelated third-party app

Detection Strategies

Perform static analysis of installed Android APKs for Intents referencing ASUS Router App package components
Review the ASUS Router App manifest and confirm which components are exported and whether they enforce permissions
Correlate mobile device management (MDM) telemetry for anomalous inter-app Intent traffic on managed devices

Monitoring Recommendations

Enroll Android devices in MDM to inventory installed applications and flag side-loaded packages
Alert on installation of applications requesting broad QUERY_ALL_PACKAGES or intent-forwarding capabilities alongside the ASUS Router App
Monitor user reports of unexpected URL redirects or credential prompts inside the ASUS Router App

How to Mitigate CVE-2026-12960

Immediate Actions Required

Update the ASUS Router App to the fixed version described in the ASUS Security Advisory as soon as it is available on Google Play
Remove untrusted or side-loaded Android applications from devices that also run the ASUS Router App
Instruct router administrators to type the router management URL manually rather than following in-app links until patching is complete

Patch Information

ASUS has published remediation guidance in the "Security Update for ASUS Router Android App" section of the ASUS Security Advisory. Apply the updated ASUS Router App release referenced in that advisory through the Google Play Store.

Workarounds

Uninstall the ASUS Router App on devices where untrusted third-party apps must remain installed, and manage the router through its web interface over the LAN
Restrict installation sources to Google Play only and disable "Install unknown apps" for all user profiles
Use Android work profiles to isolate the ASUS Router App from personal, potentially untrusted applications

bash

# Verify installed ASUS Router App version on a connected Android device
adb shell dumpsys package com.asus.aihome | grep versionName

# List other installed packages that declare Intents targeting the ASUS Router App
adb shell pm list packages -f | while read pkg; do
  path=$(echo "$pkg" | sed 's/package://; s/=.*//')
  aapt dump xmltree "$path" AndroidManifest.xml 2>/dev/null | grep -l "com.asus.aihome"
done