Full Report
ASUS has released new firmware to patch nine security vulnerabilities, including a critical authentication bypass flaw in routers with AiCloud enabled. [...]
Analysis Summary
# Vulnerability: Critical Authentication Bypass and Command Injection in ASUS Routers with AiCloud
## CVE Details
- CVE ID: CVE-2025-59366 (Primary focus of the article's detail)
- CVSS Score: Not explicitly provided, but described as **critical** authentication bypass.
- CWE: Not explicitly provided (Related to path traversal and OS command injection).
**Note:** The advisory covers nine vulnerabilities spanning firmware versions (CVE-2025-59365 through CVE-2025-59372, and CVE-2025-12003), but only CVE-2025-59366 is detailed.
## Affected Systems
- Products: ASUS Routers with **AiCloud enabled**.
- Versions: Firmware versions **prior to** the patched releases in the 3.0.0.4_386 series, 3.0.0.4_388 series, and 3.0.0.6_102 series. (The specific vulnerable router models were not listed).
- Configurations: Systems where AiCloud is active and services are accessible from the internet.
## Vulnerability Description
CVE-2025-59366 is an authentication bypass flaw occurring due to an unintended side effect of the **Samba functionality** within AiCloud. This flaw can potentially allow unauthenticated remote attackers to execute specific functions without proper authorization. The exploit chain involves chaining a **path traversal weakness** and an **OS command injection weakness**.
## Exploitation
- Status: **Not specified** if exploited in the wild, but the description implies exploitability.
- Complexity: **Low** complexity attacks are suggested.
- Attack Vector: **Network** (Remote attackers without privileges).
## Impact
- Confidentiality: Likely High (Due to command injection potential).
- Integrity: Likely High (Due to command injection potential).
- Availability: Not explicitly detailed, but could be impacted by command execution.
## Remediation
### Patches
- ASUS advises updating router firmware immediately to the latest versions available for the following series:
- 3.0.0.4_386 series
- 3.0.0.4_388 series
- 3.0.0.6_102 series
### Workarounds
- For users with **end-of-life models** that will not receive firmware updates:
1. Disable **any services accessible from the Internet**, specifically: remote access from WAN, port forwarding, DDNS, VPN server, DMZ, and port triggering.
2. Disable remote access to devices running the vulnerable AiCloud software.
3. Use strong passwords for the router administration page and wireless networks.
## Detection
- Detection methods rely on identifying services running versions older than those listed above.
- Indicators of Compromise (IOCs) related to this specific published advisory were not detailed, but monitoring for unusual network activity related to Samba services or unauthorized remote access attempts is recommended.
## References
- Vendor Advisory: hxxps://www.asus.com/security-advisory/#:~:text=Security%20Update%20for%20ASUS%20Router%20Firmware
- NVD Detail (for the critical CVE): hxxps://nvd.nist.gov/vuln/detail/CVE-2025-59366