CVE-2025-15101

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-15101
An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrators to execute arbitrary system commands via a crafted parameter. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.asus.com/security-advisory/ Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:o:asus:asus_firmware:*:*:*:*:*:*:*:*
History

13 May 2026, 04:17

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) ha sido identificada en la interfaz de gestión web de ciertos modelos de router ASUS. Esta vulnerabilidad permite potencialmente que se realicen acciones con los privilegios existentes de un usuario autenticado en el dispositivo afectado, incluyendo la capacidad de ejecutar comandos del sistema a través de mecanismos no intencionados. Consulte la sección 'Security Update for ASUS Router Firmware' en el Aviso de Seguridad de ASUS para más información.
Summary (en) A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Web management interface of certain ASUS router models. This vulnerability potentially allows actions to be performed with the existing privileges of an authenticated user on the affected device, including the ability to execute system commands through unintended mechanisms. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information. (en) An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrators to execute arbitrary system commands via a crafted parameter. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
CWE CWE-352

26 Mar 2026, 16:43

Type Values Removed Values Added
CPE cpe:2.3:o:asus:asus_firmware:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
References () https://www.asus.com/security-advisory/ - () https://www.asus.com/security-advisory/ - Vendor Advisory
First Time Asus
Asus asus Firmware

26 Mar 2026, 03:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-26 03:16

Updated : 2026-06-17 08:37

NVD link : CVE-2025-15101

Mitre link : CVE-2025-15101

CVE.ORG link : CVE-2025-15101

JSON object : View

Products Affected

asus

  • asus_firmware
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')