AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ASUSCVE-2026-13385

ASUS Router: improper certificate validation

ASUS

CVE-2026-13385 · Published Jul 15, 2026 · updated Jul 29, 2026

Critical9.5
No fix yet
ASUS advisory

An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middle(MITM) user to make the router download and execute arbitrary command via a spoofed server.

Refer to the ' 

Security Update for ASUS Router Firmware  ' section on the ASUS Security Advisory for more information.

Affected versions

PackageAffectedFixed in
Router
Product
<= 3.0.0.4_386 seriesNo fix yet
<= 3.0.0.4_388 seriesNo fix yet
<= 3.0.0.6_102 seriesNo fix yet
Details and references
CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-295, CWE-354

More ASUS advisories

All ASUS
High 7.2Jul 15ASUS GameSDK: information disclosureCVE-2026-8919no fix yetHigh 8.5Jul 15ASUS Aura Wallpaper Service: local user could perform file operationsCVE-2026-8920no fix yetHigh 8.4Jul 15ASUS Business Manager: untrusted pointer dereferenceCVE-2026-15029no fix yetMedium 5.6Jul 15ASUS Business Manager: out-of-bounds readCVE-2026-15030no fix yetHigh 8.2Jul 15ASUS Business Manager: information disclosureCVE-2026-13585no fix yetMedium 5.9Jul 15ASUS Router: SQL injectionCVE-2026-11851no fix yet