CVE-2026-75753: ASUS Router Auth Bypass Vulnerability

CVE-2026-75753 Overview

CVE-2026-75753 is a missing authentication vulnerability [CWE-306] affecting certain ASUS router firmware. An unauthorized user on the adjacent network can send specific HTTP requests to the router without providing credentials. The router responds with device identification information and transitions into a specific operational mode. Once the device is placed into this mode, it may fail to perform self-recovery when it encounters abnormal conditions. ASUS has published mitigation guidance in its Security Advisory and released firmware updates for affected models.

Critical Impact
Adjacent network attackers can retrieve device identification data and force affected ASUS routers into a state that prevents automatic recovery from abnormal conditions.

Affected Products

Certain ASUS wireless router models (see ASUS Security Advisory)
ASUS router firmware versions listed in the "Security Update for ASUS Router Firmware" section of the advisory
Deployments reachable from the adjacent (local) network

Discovery Timeline

2026-10-20 - CVE CVE-2026-75753 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-75753

Vulnerability Analysis

The flaw is a Missing Authentication for a Critical Function weakness classified under [CWE-306]. The affected ASUS routers expose an HTTP endpoint that accepts specific commands without validating the identity of the requester. An attacker on the adjacent network, such as a connected Wi-Fi or LAN segment, can issue these commands directly. The router responds by returning device identification details and switching into a specific internal mode. In that mode, the router loses the ability to recover automatically when it encounters abnormal operating conditions, which affects availability over time.

Root Cause

The underlying cause is the absence of an authentication check on an HTTP-accessible function that controls diagnostic or operational state. Critical commands that should require administrative authorization are instead reachable by any client that can send requests to the router's web interface. Information disclosure and state manipulation both result from this single missing control.

Attack Vector

Exploitation requires network adjacency rather than remote internet access. The attacker must be on the same local or wireless network as the router. No credentials, user interaction, or special preconditions are needed. The attacker sends crafted HTTP requests to the affected endpoint, which triggers the information response and the mode change. Because no verified proof-of-concept has been published, exploitation details beyond those in the advisory are not public. Refer to the ASUS Security Advisory for technical specifics.

Detection Methods for CVE-2026-75753

Indicators of Compromise

Unexpected HTTP requests to administrative endpoints on the router originating from adjacent LAN or Wi-Fi clients.
Router responses containing device identification data sent to clients that have not completed authentication.
Routers reporting an abnormal operational mode or failing to recover from transient faults without manual reboot.

Detection Strategies

Inspect router access logs for unauthenticated HTTP requests targeting management URIs from local clients.
Correlate client MAC and IP activity with HTTP traffic directed at the router management interface.
Baseline router uptime and self-recovery events to flag devices that stop recovering automatically.

Monitoring Recommendations

Forward router syslog and HTTP access logs to a centralized SIEM for retention and analysis.
Alert on repeated management-interface requests from non-administrative hosts on the LAN.
Monitor firmware version inventory across deployed ASUS routers to confirm patched state.

How to Mitigate CVE-2026-75753

Immediate Actions Required

Apply the firmware update listed in the "Security Update for ASUS Router Firmware" section of the ASUS Security Advisory.
Restrict access to the router management interface to trusted administrative hosts only.
Disable Wi-Fi guest networks or isolate them from the router management VLAN until patching is complete.

Patch Information

ASUS has released firmware updates addressing CVE-2026-75753. Administrators should consult the ASUS Security Advisory to confirm the exact firmware version required for their router model and apply the update through the router's web administration interface or the ASUS Router app.

Workarounds

Segment the network so that untrusted devices cannot reach the router's HTTP management interface.
Enforce strong WPA2 or WPA3 Wi-Fi credentials to limit who can join the adjacent network.
Disable remote and local HTTP management features that are not required for daily operation.

bash

# Configuration example
# Verify installed firmware version on an ASUS router via SSH
nvram get buildno
nvram get extendno
# Review the ASUS Security Advisory for the fixed version matching your model