CVE-2026-14911: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in ASUS Router

This vulnerability (CWE-79) in ASUS router modules involves improper neutralization of input during web page generation, enabling cross-site scripting attacks. An attacker can exploit this by crafting a URL that, when visited by an authenticated user, allows reading of DOM information, modification of router settings, and denial-of-service conditions. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. No patch or remediation details are provided in the input data.

Successful exploitation can lead to unauthorized reading of DOM information, unauthorized modification of router settings, and denial-of-service conditions affecting the router's availability. The attack requires an authenticated user to visit a maliciously crafted URL, which could result in significant compromise of router functionality and security.

Patch status is not yet confirmed — check the ASUS Security Advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor advisory for updates. Until a fix is available, avoid visiting untrusted URLs while authenticated to the router's web interface.