CVE-2025-12003VulnerabilityPublished 25 Nov 2025

CVE-2025-12003: ASUS Router · Missing Authentication

Affects ASUS RouterSource CVE Database V5

Not known to be exploited · CVSS 8.2 High.

Data as of 26 Oct 2026, 06:26 UTC

CVSS 4.0 base score

8.2High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.6% chance of exploitation in 30 days – higher than 50% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: Present
Privileges Required: None
User Interaction: None
Vulnerable system confidentiality: None
Vulnerable system integrity: High
Vulnerable system availability: None
Subsequent system confidentiality: None
Subsequent system integrity: None
Subsequent system availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Attack Requirements: Present: The successful attack depends on the presence of specific deployment and execution conditions of the vulnerable system that enable the attack. These include: a race condition must be won to successfully exploit the vulnerability (the successfulness of the attack is conditioned on execution conditions that are not under full control of the attacker, or the attack may need to be launched multiple times against a single target before being successful); the attacker must inject themselves into the logical network path between the target and the resource requested by the victim (e.g. vulnerabilities requiring an on-path attacker).
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without interaction from any human user, other than the attacker.
Vulnerable system confidentiality: None: There is no loss of confidentiality within the Vulnerable System.
Vulnerable system integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the vulnerable system. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the vulnerable system.
Vulnerable system availability: None: There is no impact to availability within the Vulnerable System.
Subsequent system confidentiality: None: There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System.
Subsequent system integrity: None: There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System.
Subsequent system availability: None: There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System.

Definitions: FIRST CVSS v4.0 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

1. Immediate application of the latest firmware updates from ASUS once available, as these will address the authentication and path traversal issues. 2. Disable the WebDAV service on affected routers if it is not essential to operations, thereby removing the attack surface. 3. Implement network segmentation to isolate critical router management interfaces from general network access, limiting exposure to external attackers. 4. Employ strict firewall rules to restrict access to router management ports and WebDAV services only to trusted IP addresses. 5. Monitor network traffic for unusual WebDAV requests or path traversal patterns indicative of exploitation attempts. 6. Conduct regular security audits and vulnerability scans on network devices to detect outdated firmware or misconfigurations. 7. Educate IT staff on the risks associated with router vulnerabilities and the importance of timely patch management. 8. Consider deploying intrusion detection/prevention systems (IDS/IPS) with signatures tuned to detect exploitation attempts targeting this vulnerability.

Description

CVE-2025-12003 is a high-severity vulnerability affecting certain ASUS router firmware versions that exposes a path traversal flaw in the WebDAV service. This flaw allows unauthenticated remote attackers to bypass authentication controls and potentially modify critical device files, impacting device integrity. The vulnerability stems from missing authentication for critical functions (CWE-306) combined with path traversal (CWE-22). Exploitation does not require user interaction or privileges, making it highly accessible to attackers. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to network infrastructure relying on affected ASUS routers. European organizations using these router versions are at risk of unauthorized device manipulation, which could lead to network compromise or disruption. Immediate firmware updates and disabling WebDAV where unnecessary are recommended mitigations. Countries with high ASUS router market penetration and critical infrastructure reliance on these devices are most likely to be impacted.

Impact

For European organizations, this vulnerability poses a significant risk to network security and operational stability. Compromise of ASUS routers through this flaw could allow attackers to alter device configurations, inject malicious firmware, or disrupt routing functions, potentially leading to network outages or man-in-the-middle attacks. Critical infrastructure sectors such as finance, healthcare, and government agencies that rely on these routers for secure communications could face data integrity breaches or service disruptions. The unauthenticated nature of the exploit increases the likelihood of automated scanning and exploitation attempts, raising the threat level. Additionally, compromised routers could serve as footholds for lateral movement within corporate networks or as platforms for launching further attacks. The impact extends beyond individual organizations to national cybersecurity posture, especially where ASUS routers are widely deployed in public sector or critical infrastructure networks.

Summary

CVE-2025-12003 is a vulnerability identified in ASUS routers running firmware versions 3.0.0.4_386, 3.0.0.4_388, and 3.0.0.6_102. The vulnerability involves a path traversal flaw within the WebDAV service implementation, which allows unauthenticated remote attackers to access and potentially modify sensitive files on the device. The root cause is missing authentication for critical functions (CWE-306), meaning that the WebDAV interface does not properly verify user credentials before permitting access to sensitive operations. Additionally, the path traversal issue (CWE-22) enables attackers to navigate outside the intended directory structure, further facilitating unauthorized file access or modification. The CVSS 4.0 score of 8.2 reflects the high severity, with an attack vector of network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and high impact on integrity (VI:H). The vulnerability does not affect confidentiality or availability directly but compromises the integrity of the router’s firmware or configuration files, potentially allowing attackers to implant malicious code or disrupt normal operations. Although no known exploits have been reported in the wild, the ease of exploitation and lack of authentication make this a critical concern. The vulnerability was publicly disclosed on November 25, 2025, with ASUS providing security advisories but no direct patch links included in the provided data. The affected routers are commonly used in both consumer and enterprise environments, making the threat relevant to a broad user base.

CWE-306Missing Authentication for Critical Function (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #21OWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Architecture and Design
Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
Architecture and Design
Where possible, avoid implementing custom, "grow-your-own" authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment.
OWASP Cheat Sheets
OWASP Authentication (opens in a new tab)
OWASP ASVS 4.0.3
V1.2.3 (opens in a new tab)
V1.2.2 (opens in a new tab)
V1.2.4 (opens in a new tab)
Attack patterns
Choosing Message Identifier (opens in a new tab)
Force the System to Reset Values (opens in a new tab)
Using Unpublished Interfaces or Functionality (opens in a new tab)
Cross Site Request Forgery (opens in a new tab)
Communication Channel Manipulation (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #6OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
OWASP Cheat Sheets
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V12.3.1 (opens in a new tab)
Attack patterns
Path Traversal (opens in a new tab)
Using Slashes and URL Encoding Combined to Bypass Validation Logic (opens in a new tab)
Manipulating Web Input to File System Calls (opens in a new tab)
Using Escaped Slashes in Alternate Encoding (opens in a new tab)
Using Slashes in Alternate Encoding (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

asus.com/security-advisory/ (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 2 Dec 2025, 14:51 UTC

WeaknessesCWE-306, CWE-22

Technical details

References

Community reviews

Related threats