According to TweakTown, the affected devices are WiFi 7 models, a lineup that runs from the ROG Rapture and ROG Strix gaming routers to the RT series. The headline is broader than the official record, though. ASUS identifies the affected products by firmware series, not by a model list. Don't assume every WiFi 7 router is affected, and don't assume yours is safe because of its marketing label. Check the firmware version it's actually running.
The short version
- Affected: ASUS routers on the 3.0.0.6_102 firmware series.
- Fixed: three vulnerabilities: CVE-2026-75775, CVE-2026-75779 and CVE-2026-93489.
- Severity: all three are rated High under CVSS 4.0, scoring 7.7, 8.6 and 8.7.
- Exploitation: none reported so far.
- What to do: find your exact model on ASUS Support and install the newest firmware listed for it. If you can't do that yet, apply the temporary mitigations below.
One flaw that skips the password, two that run commands as root
The coverage so far tends to lump all three CVEs together as "unauthenticated attacker gets admin." They are actually three different bugs, with different conditions an attacker has to meet.
CVE-2026-93489: authentication bypass (CVSS 8.7)
This is the flaw behind the headlines. Its CVE record says improper authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations. The CVSS 4.0 vector rates it adjacent-network, low complexity, no privileges required, no user interaction, and with no extra attack requirements. In other words, someone on the right network has an easy path.
ASUS's bulletin describes it this way: "an unauthenticated attacker on an adjacent network may gain administrative access to the router." A breakdown by security firm Safeguard says ASUS then asks all users to update to the latest firmware immediately and lists four fallback steps for anyone who cannot.
CVE-2026-75775: command injection in factory-default state (CVSS 7.7)
ASUS's CVE record calls this an OS command injection that lets an attacker run arbitrary commands with root privileges by sending crafted parameters. The catch is that the router has to be in its factory-default state. The CVSS vector marks "attack requirements" as present, which reflects that condition. The router most at risk is one that's freshly reset or still in the box, not one that's been set up and running for months.
CVE-2026-75779: command injection via CSRF (CVSS 8.6)
This one combines OS command injection with cross-site request forgery (CSRF). An attacker tricks a logged-in administrator into visiting a malicious website, and the router then executes arbitrary commands as root. It depends on a person clicking, which is a different threat model from the other two. It's also a good argument for logging out of the router's admin page when you're done instead of leaving it open in a tab for a week.
A note on conflicting reports
Some outlets have attributed the no-password admin access to CVE-2026-75775. Mezha.net, citing Notebookcheck, wrote that CVE-2026-75775 affects certain Asus router models running firmware in the 3.0.0.6_102 series. Under specific conditions, an attacker on an adjacent network could gain administrator access without authentication. The official CVE records don't support that. They describe 75775 as factory-default command injection and pin the authentication bypass on 93489.
The severity ratings differ too. Vulnerability database VulDB reports a vulnerability marked as very critical in ASUS Router 3.0.0.6_102 series and gives CVE-2026-93489 its own base score of 10.0. It also says the attack is possible to be carried out remotely. That doesn't match ASUS's own CVSS 4.0 vector, which says adjacent network. ASUS is the CVE Numbering Authority for these flaws and wrote the records, so the 8.7 and the adjacent-network classification are the authoritative ones. It's still worth knowing that some third-party trackers rate it more harshly.
Summary: One flaw (93489) skips the password, one (75775) targets routers in their factory-default state, and one (75779) needs an admin to click a bad link. All three are fixed by the same firmware update.
How worried should you be?
"Adjacent network" is the main thing limiting the risk. The attacker has to share a network segment with the router, so a random scanner on the other side of the world can't reach it. OC3D summed it up: these flaws require access to an adjacent network, which means that attackers need to be close to your router to conduct an attack. Even so, users of affected ASUS routers should update them as soon as possible.
"Close" covers more than it sounds, though. These are some of the people who could be on your network:
- Anyone who has your Wi-Fi password: guests, neighbors, former roommates.
- Any compromised device already on your LAN, like a cheap smart plug or an old laptop.
- Customers and staff in a small office or shop that runs a consumer router.
There's no evidence of attacks so far. Safeguard notes that no exploitation is reported and none is in CISA's KEV catalog. In CISA's SSVC enrichment for CVE-2026-75775, exploitation is marked as "none," automatable as "no," and technical impact as "total." Put simply, no one is known to be using it, but anyone who does can take over the whole router.
This isn't the first fix for this firmware branch this month. Cybernews reported an earlier October advisory: tracked as CVE-2026-14157, ASUS rates the flaw as critical with a severity score of 9.4 out of 10. It affects routers running ASUS firmware from the 3.0.0.6_102 series. That was a separate bug involving malicious VPN files. If you skipped that update, this one is another reason to catch up.
What to do now
Step 1: Check your firmware branch
Log in to your router's web admin interface or the ASUS Router app and find the installed firmware version. If it starts with 3.0.0.6_102, this advisory applies to you.
Step 2: Install the latest firmware for your exact model
TweakTown reports that the patched firmware is available on ASUS's official support site and on each WiFi 7 router's product page. Neither ASUS's advisory nor the coverage lists a single build number for every model, so there's no "install version X" answer. Search ASUS Support for your exact model name, download the newest firmware listed for it, and install it through the router's admin interface. If the router's built-in firmware check finds an update, you can use that instead.
Some practical tips:
- Update from a wired connection if you can, and don't power the router off mid-flash.
- After the reboot, check that the firmware version has actually changed.
- If you have an AiMesh setup, check the firmware version on every node, not just the main router.
Step 3: If you can't update yet, reduce the risk
TweakTown summarizes ASUS's interim steps as:
- Use strong passwords. Set a strong password of at least 10 characters for both the router admin page and the Wi-Fi network.
- Restrict remote management. Limit web-based router management to trusted local networks.
- Review connected devices and sessions. Remove any devices or sessions you don't recognize.
- Turn off WAN remote access. TweakTown says several ASUS WiFi 7 routers have remote access from the WAN enabled by default. We couldn't confirm which models ship that way, so check your own settings rather than assuming.
These steps are stopgaps, not fixes. A strong password doesn't help against an authentication bypass that skips the password check entirely. What the steps do is limit who can reach the router and give you a chance to spot an intruder. Only the firmware update closes the holes.
Step 4: Avoid the CSRF trap
Because of CVE-2026-75779, avoid browsing other websites while you're logged in to the router's admin page. Log in, make your changes, log out.
Summary: Check the firmware branch, update to the latest build for your model, and treat the mitigations as a temporary measure until you can.
Don't confuse this with the end-of-life router warnings
ASUS published other router bulletins around the same time, and they're easy to mix up with this one. OC3D notes that for the 3.0.0.4_386 and 3.0.0.4_388 router firmware series, ASUS has provided "EOL Guidance". That means that these new security flaws affect some of ASUS' unsupported router models. No updates are available for these router models, and ASUS recommends replacing them with newer models.
Those are separate flaws on older firmware branches, and they aren't part of the 3.0.0.6_102 fix. If your router runs one of those older branches, waiting for a patch won't help, because ASUS isn't releasing one. Plan a replacement.
The bigger picture
ASUS handled the disclosure well. All three CVE records went live within hours of the bulletin. ASUS issues its own CVE IDs, and the coordinated release meant the patch arrived along with the details.
The weak point is how the patch reaches people. Most home users don't read security bulletins, and many routers sit unattended in a closet for years. A fix only works once it's installed. If you manage your family's network, a small office, or a few AiMesh nodes at a relative's house, check them this week.
When did you last check your router's firmware version?