CVE-2026-19396: CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG) in ASUS Router
Description
CVE-2026-19396 is a vulnerability in the ASUS RT-BE57 router involving a predictable seed in the pseudo-random number generator used for IFTTT pairing token generation. This flaw allows an unauthenticated nearby attacker to derive the pairing token by observing values from an administrator-initiated IFTTT pairing session. Exploitation could enable the attacker to read or modify router settings. The vulnerability has a high severity score of 7.7 (CVSS 4.0). No patch or remediation details are provided in the available data.
CVSS v4.0
Score 7.7high
Affected software
ASUS
Router
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The ASUS RT-BE57 router's IFTTT pairing token generation uses a pseudo-random number generator (PRNG) seeded with predictable values (CWE-337). This weakness allows an unauthenticated attacker in proximity to derive the pairing token by observing an administrator's pairing session. With the token, the attacker can read or modify router settings, potentially compromising device integrity and configuration. The CVSS 4.0 base score is 7.7, reflecting high impact and attack complexity requiring physical proximity and partial user interaction.
Potential Impact
An unauthenticated nearby attacker can derive the IFTTT pairing token due to predictable PRNG seeding, enabling unauthorized reading or modification of router settings. This compromises router security and may lead to unauthorized control or configuration changes.
Mitigation Recommendations
Patch status is not yet confirmed — check the ASUS Security Advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, limit physical proximity access to the router and monitor for unusual configuration changes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- ASUS
- Date Reserved
- 2026-08-10T07:25:54.054Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac5ac102cdf04f65602fce1
Added to database: 10/07/2026, 02:18:56 UTC
Last enriched: 10/07/2026, 02:33:13 UTC
Last updated: 10/07/2026, 02:34:03 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.