This vulnerability (CVE-2025-15101) involves improper neutralization of special elements used in OS commands (CWE-78) within the web management interface of ASUS routers. Remote authenticated administrators can exploit this flaw by sending crafted parameters that lead to arbitrary command execution on the underlying system. The affected firmware version is 3.0.0.6_102. The CVSS 4.0 base score is 8.6, indicating a high impact with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote authenticated administrators to execute arbitrary system commands, potentially leading to full system compromise, data loss, or service disruption. The vulnerability impacts the confidentiality, integrity, and availability of the affected router systems. However, exploitation requires administrative credentials, limiting the attack surface to trusted users or compromised accounts.

Patch status is not yet confirmed — check the ASUS Security Advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted personnel only and consider additional network-level protections to limit access to the router management interface.