CVE-2026-16528: ASUS Router Log File Disclosure Vulnerability

CVE-2026-16528 Overview

CVE-2026-16528 is an information disclosure vulnerability affecting certain ASUS router models. The firmware writes Dynamic DNS (DDNS) credentials into the system log in cleartext. A remote authenticated attacker on an adjacent network can read these entries and recover the DDNS account credentials. With valid DDNS credentials, an attacker can alter DNS settings tied to the router's dynamic hostname, redirecting user traffic or supporting follow-on attacks. The weakness is categorized under CWE-532: Insertion of Sensitive Information into Log File. ASUS has published remediation guidance in its security advisory.

Critical Impact
Authenticated attackers on the adjacent network can harvest DDNS credentials from logs and manipulate DNS records that resolve the router's dynamic hostname.

Affected Products

ASUS router firmware (specific models listed in the ASUS Security Advisory)
Routers with DDNS service enabled and system logging active
Deployments where administrative access extends to multiple local accounts or shared Wi-Fi segments

Discovery Timeline

2026-10-07 - CVE CVE-2026-16528 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-16528

Vulnerability Analysis

The vulnerability exists in how certain ASUS router firmware handles DDNS configuration and runtime events. The firmware logs DDNS registration and update activity to the system log, and the log entries include the credentials used to authenticate against the DDNS provider. Any authenticated user with permission to view the system log can retrieve these credentials. The attack requires network adjacency, meaning the attacker must be reachable from the router's LAN or management interface rather than the public internet. Once DDNS credentials are obtained, the attacker can log in to the DDNS provider and change the DNS records that map the router's hostname to an IP address.

Root Cause

The root cause is improper separation of diagnostic data and secret material. The logging routines emit DDNS session details without redacting authentication parameters. [CWE-532] applies when sensitive values such as passwords, tokens, or API keys are written to log sinks that have a different, broader access boundary than the credential store itself.

Attack Vector

The attacker authenticates to the router over the adjacent network, opens the system log through the web UI or supported management channel, and extracts the DDNS username and password strings. The attacker then authenticates to the DDNS provider using the recovered credentials and modifies the A or CNAME record associated with the router. Clients that resolve the hostname receive attacker-controlled IP addresses, enabling phishing, man-in-the-middle interception, or redirection to malicious infrastructure.

No verified public exploit code is available. The exploitation flow is described in prose because no realCodeExamples were provided. Refer to the ASUS Security Advisory for firmware-specific details.

Detection Methods for CVE-2026-16528

Indicators of Compromise

Unexpected changes to DNS records associated with the router's DDNS hostname
System log access events from non-administrative or newly created local accounts
DDNS provider login activity from IP addresses that do not match the router's WAN address
Client reports of certificate warnings or redirection when accessing services published through the DDNS hostname

Detection Strategies

Monitor administrative sessions on the router and alert on access to the system log view by non-owner accounts
Correlate DDNS provider audit logs with expected update sources to flag out-of-band logins
Compare resolved IP addresses for the DDNS hostname against the router's known WAN IP on a scheduled basis

Monitoring Recommendations

Enable remote syslog forwarding from the router to a central collector and retain logs for review
Track DNS resolution drift for any hostname tied to the router's DDNS account
Review the ASUS vendor advisory feed for additional affected models and firmware versions

How to Mitigate CVE-2026-16528

Immediate Actions Required

Apply the firmware update referenced in the ASUS Security Advisory for the affected router model
Rotate the DDNS account password immediately after patching
Review the DDNS provider's DNS records and revert any unauthorized changes
Audit local router accounts and remove any that are not required

Patch Information

ASUS has released firmware updates addressing CVE-2026-16528. Consult the vendor advisory for the exact firmware version per model and apply the update through the router's web interface or ASUS firmware update utility. After installation, clear existing system logs so historical credential entries are not retained.

Workarounds

Disable DDNS on the router until firmware can be updated
Restrict system log access to the primary administrator account only
Segment the management interface from untrusted LAN clients and guest Wi-Fi networks
Use a DDNS account dedicated to the router with no reuse of credentials from other services

bash

# Configuration example
# Post-patch hardening steps on an ASUS router (illustrative)
# 1. Update firmware to the version listed in the ASUS advisory
# 2. Rotate the DDNS credential
# 3. Clear historical logs that may contain the old secret
# 4. Restrict log viewing to admin