This vulnerability (CVE-2026-13385) affects certain ASUS routers due to improper validation of integrity check values (CWE-354) and improper certificate validation (CWE-295). An unauthenticated remote attacker capable of man-in-the-middle interception can exploit this flaw to cause the router to download and execute arbitrary commands from a malicious, spoofed server. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impacts on confidentiality, integrity, availability, and security requirements. No vendor advisory or patch information is currently available to confirm remediation status.

Successful exploitation allows a remote attacker to execute arbitrary commands on the affected ASUS router without authentication, potentially leading to full compromise of the device. This can result in loss of confidentiality, integrity, and availability of the router and connected networks. The vulnerability is critical given the high CVSS score and the ability to perform remote code execution via MITM.

Patch status is not yet confirmed — check the ASUS Security Advisory for current remediation guidance. Until an official fix is released, users should avoid connecting ASUS routers to untrusted networks where MITM attacks are possible and monitor vendor communications closely for updates.