This vulnerability in the Asus RT-N12+ router involves CSV Injection through the client name parameter. An authenticated administrator can insert malicious commands or formulas that are embedded in CSV exports. When another user opens the exported CSV file, these commands may be executed, potentially leading to command injection impacts. The CVSS vector indicates the attack requires adjacent network access, low attack complexity, and high privileges with user interaction, resulting in partial confidentiality, integrity, and availability impacts.

An attacker with administrator privileges can inject malicious content into CSV exports, which may be executed when the CSV file is opened by another user. This can lead to partial compromise of confidentiality, integrity, and availability of the affected system or data. However, exploitation requires high privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit administrator access to trusted personnel and exercise caution when exporting and opening CSV files containing client names from the Asus RT-N12+ router.