ASUSCVE-2026-13385

ASUS Router: improper certificate validation

Critical9.5CVE-2026-13385 · Published Jul 15, 2026 · updated Jul 29, 2026

An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middle(MITM) user to make the router download and execute arbitrary command via a spoofed server. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

ASUS advisory

Affected versions

Package	Affected	Fixed in
Router Product	<= 3.0.0.4_386 series	No fix yet
	<= 3.0.0.4_388 series	No fix yet
	<= 3.0.0.6_102 series	No fix yet

Details and references

CVSS 4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-295, CWE-354

More ASUS advisories

All ASUS

Date	Advisory	Severity	Fixed in
Jul 15	ASUS GameSDK: information disclosure High7.2Jul 15 CVE-2026-8919No fix yet	High7.2	No fix yet
Jul 15	ASUS Aura Wallpaper Service: local user could perform file operations High8.5Jul 15 CVE-2026-8920No fix yet	High8.5	No fix yet
Jul 15	ASUS Business Manager: untrusted pointer dereference High8.4Jul 15 CVE-2026-15029No fix yet	High8.4	No fix yet
Jul 15	ASUS Business Manager: out-of-bounds read Medium5.6Jul 15 CVE-2026-15030No fix yet	Medium5.6	No fix yet
Jul 15	ASUS Business Manager: information disclosure High8.2Jul 15 CVE-2026-13585No fix yet	High8.2	No fix yet
Jul 15	ASUS Router: SQL injection Medium5.9Jul 15 CVE-2026-11851No fix yet	Medium5.9	No fix yet

Affected versions

More ASUS advisories

Critical advisories by email