This vulnerability (CVE-2026-13385) affects certain ASUS routers due to improper validation of integrity check values (CWE-354) and improper certificate validation (CWE-295). An attacker capable of performing a man-in-the-middle attack can exploit these weaknesses to cause the router to download and execute arbitrary commands from a malicious, spoofed server. The vulnerability is rated critical with a CVSS 4.0 score of 9.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, availability, and security requirements. No patch or remediation level has been provided by ASUS at this time, and no affected versions are explicitly identified.

Successful exploitation allows a remote unauthenticated attacker in a man-in-the-middle position to execute arbitrary commands on the affected router. This can lead to full compromise of the device, including control over network traffic and potential further attacks on connected systems. The vulnerability severely impacts confidentiality, integrity, and availability of the router and its managed network.

Patch status is not yet confirmed — check the ASUS Security Advisory for current remediation guidance. Until an official fix is released, users should avoid connecting their ASUS routers to untrusted networks where man-in-the-middle attacks are possible. Monitor ASUS communications for firmware updates addressing this vulnerability.