CVE-2026-14157

Published Oct 1, 2026

Last updated 10 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-14157 is a vulnerability involving the use of an externally controlled format string within ASUS router modules, specifically affecting devices running the 3.0.0.6_102 series firmware. The issue occurs when the router's web management interface processes an uploaded file, such as a VPN client configuration file. If the file contains crafted text, the system reads the input as formatting instructions rather than plain data, allowing an authenticated remote user to execute arbitrary commands on the device. To address this vulnerability, ASUS has released firmware updates for the affected router models. In the interim, the manufacturer advises users to only import VPN client configuration files from trusted sources and to avoid using files obtained from unknown or publicly shared origins.

Description: Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface.
Source: 54bf65a7-a193-42d2-b1ba-8e150d3c35e1
NVD status: Awaiting Analysis

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.4
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

Weaknesses

54bf65a7-a193-42d2-b1ba-8e150d3c35e1: CWE-134

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 4

References