The vulnerability CVE-2026-12960 in the ASUS Router Android app arises from improper export of application components (CWE-926). This allows a local third-party application to send a crafted Intent to the ASUS Router app, triggering it to open a specified URL. The CVSS 4.0 base score is 6.0 (medium severity), with attack vector local, low attack complexity, no privileges required, and user interaction required. No official remediation level or patch information is currently available from the vendor advisory. The vulnerability does not affect cloud services and no known exploits are reported in the wild.

A malicious app installed on the same Android device can exploit this vulnerability to cause the ASUS Router app to open arbitrary URLs. This could potentially be used for phishing or redirecting users to malicious web content. However, the attack requires local access and user interaction, limiting the scope and impact. There is no indication of privilege escalation, data disclosure, or remote exploitation.

Patch status is not yet confirmed — check the ASUS Security Advisory for current remediation guidance. Until an official fix is released, users should be cautious about installing untrusted applications on the same device as the ASUS Router app to reduce risk. No vendor advisory or patch links are currently provided.