CVE-2026-14157: ASUS Router RCE Vulnerability

CVE-2026-14157 Overview

CVE-2026-14157 is a format string vulnerability affecting ASUS Router modules. The flaw resides in the web management interface, where router modules process uploaded files without sanitizing format specifiers. A remote authenticated user can upload a crafted file to trigger arbitrary command execution on the device. The weakness is classified under [CWE-134] (Use of Externally Controlled Format String).

Successful exploitation grants attackers control over the router operating system, enabling traffic interception, lateral movement into protected networks, and persistence on the device. ASUS has published a security advisory addressing the issue.

Critical Impact
A remote authenticated attacker can execute arbitrary commands on affected ASUS routers by uploading a crafted file through the web management interface, compromising the integrity, confidentiality, and availability of the router and connected network.

Affected Products

ASUS Router modules exposing the web management interface
ASUS firmware versions covered by the vendor advisory
Router deployments where authenticated users can access the file upload functionality

Discovery Timeline

2026-10-01 - CVE-2026-14157 published to the National Vulnerability Database (NVD)
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-14157

Vulnerability Analysis

The vulnerability stems from improper handling of user-controlled input passed as a format string to a printf-family function inside ASUS Router modules. When the web management interface parses an uploaded file, attacker-supplied content reaches a formatting routine without sanitization. Format specifiers such as %s, %x, and %n are then interpreted by the function.

Attackers can leverage read specifiers to leak stack memory, including sensitive pointers and credentials. Write specifiers such as %n allow arbitrary memory writes, which can be chained to redirect execution flow. On embedded router firmware, this typically results in arbitrary command execution under the privileges of the web server process, often root.

The attack requires authentication to the web management interface. However, routers frequently retain default or weak administrator credentials, and credentials are reusable across sessions. Once code execution is achieved, attackers can disable security controls, modify DNS settings, or deploy persistent implants in firmware storage.

Root Cause

The root cause is the direct use of externally controlled data as the format argument in a C formatting function. Secure coding practice requires passing user data through a %s placeholder rather than concatenating it into the format string. Missing this control allows format specifiers in uploaded files to be parsed as instructions.

Attack Vector

Exploitation occurs over the network through the router's web management interface. An authenticated user submits a specially crafted file containing format specifiers through the upload functionality. The router processes the file and executes attacker-controlled commands. See the ASUS Security Advisory for technical details on affected endpoints.

Detection Methods for CVE-2026-14157

Indicators of Compromise

Unexpected file uploads to the ASUS router web management interface from unusual source addresses
Router administrator sessions originating from external or non-corporate IP ranges
Unknown processes or outbound connections initiated by the router firmware
Modified DNS or routing configurations without a corresponding change ticket

Detection Strategies

Inspect router administrative logs for file upload events containing format specifier sequences such as %s, %x, or %n
Correlate authentication events with upload actions to identify brute-forced or reused administrator credentials
Monitor router firmware integrity using vendor-provided verification tools and compare hashes against known-good baselines

Monitoring Recommendations

Forward router syslog data to a centralized SIEM for retention and correlation with network telemetry
Alert on administrative logins occurring outside maintenance windows or from untrusted networks
Baseline outbound traffic from the router management plane and alert on deviations consistent with command-and-control activity

How to Mitigate CVE-2026-14157

Immediate Actions Required

Apply the firmware update published in the ASUS security advisory to all affected routers
Restrict access to the web management interface to trusted internal networks and disable WAN-side administration
Rotate all router administrator credentials and enforce strong, unique passwords
Audit recent file uploads and administrative actions for signs of exploitation

Patch Information

ASUS has released firmware updates addressing CVE-2026-14157. Administrators should consult the ASUS Security Advisory for the current list of patched firmware versions and apply the appropriate update for each router model.

Workarounds

Disable remote web management on the WAN interface until firmware updates are applied
Place router management interfaces behind a VPN or jump host accessible only to administrators
Limit administrative accounts and remove unused credentials that could serve as entry points
Segment the router management VLAN from general user traffic to reduce exposure