ASUS urges router owners to install urgent firmware updates

ASUS is urging router owners to install new firmware after disclosing three vulnerabilities that could, in certain circumstances, let attackers reach administrative functions without a password. The flaws affect some routers running firmware in the 3.0.0.6_102 series, although ASUS has not published a complete affected-model list in the material reviewed for this report.¹

The most serious of the three issues is CVE-2026-93489, which carries a CVSS 4.0 score of 8.7. According to the available disclosure, it can be exploited by an unauthenticated attacker on an adjacent network without user interaction. CVE-2026-75779 is scored at 8.6 and requires user interaction but no prior privileges, while CVE-2026-75775 is scored at 7.7 and affects certain routers running the 3.0.0.6_102 firmware line.²

That “adjacent network” detail matters. This is not a claim that every router on the internet is immediately exposed to anyone, anywhere. It does mean that a hostile device already close to the network — such as a compromised machine on the same local environment or a nearby attacker able to reach the relevant interface — could have a much more direct route to the router than a remote, fully external attacker would.

ASUS’s stated fix is straightforward: install the latest firmware available for the relevant router model. The company’s security-advisory page is the best starting point, but owners should also check the support page for their exact product rather than assuming that a firmware number applies across the entire range.¹ The disclosure does not provide enough model information to safely say that every ASUS router needs the same package.

If an update is not immediately available, ASUS recommends temporary defensive steps including disabling remote administration from the WAN, using long and unique passwords for both the router account and Wi-Fi, allowing only trusted devices to connect, reviewing linked devices and companion-app sessions, and rebooting after the firmware installation. Those measures reduce exposure, but they are not a substitute for the vendor’s patch.

The practical takeaway is less dramatic than the headline but more useful: identify the exact ASUS model, check the vendor’s advisory and support pages, and apply the matching firmware. Owners should not download a package meant for another router merely because its version number looks newer. If the router cannot be updated, remote access should stay disabled until ASUS provides a supported fix.

Our opinion

This is the sort of security update that deserves attention without panic. The scores are high enough to justify acting promptly, yet the limited affected-model information means blanket advice would be irresponsible. ASUS needs to make the affected product list and patch status easy to verify; users, meanwhile, should treat their router like any other internet-facing computer rather than a set-and-forget appliance.