CVE-2026-16528: CWE-532: Insertion of Sensitive Information into Log File in ASUS Router

This vulnerability involves the insertion of sensitive DDNS credentials into system log files on certain ASUS routers. An attacker with remote authenticated access can retrieve these credentials from the logs, potentially allowing them to alter DNS configurations. The CVSS 4.0 base score is 8.4, reflecting high severity with attack vector requiring authentication but low attack complexity and no user interaction. The vulnerability is identified as CWE-532, related to the exposure of sensitive information through logging mechanisms. No vendor advisory or patch details are provided in the input data.

An attacker who is remotely authenticated can obtain DDNS credentials from the router's system logs. This exposure could lead to unauthorized modification of DNS settings, potentially impacting network traffic routing or enabling further attacks. The vulnerability does not appear to be exploitable without authentication, and no known exploits are reported in the wild.

Patch status is not yet confirmed — check the ASUS Security Advisory for current remediation guidance. Until an official fix is available, restrict remote authenticated access to the router management interface and monitor for unauthorized access attempts. Follow vendor instructions once a security update is released.