ASUS has released critical firmware updates to address a high-severity security vulnerability in multiple router firmware branches that could allow remote attackers to execute arbitrary commands on affected devices through a man-in-the-middle attack. The flaw, tracked as CVE-2026-13385, impacts widely deployed ASUS router firmware versions including 3.0.0.4_386, 3.0.0.4_388, and 3.0.0.6_102. ASUS is strongly urging all users and network administrators to upgrade to the latest patched firmware releases immediately, describing the update as critical to preventing exploitation on devices that serve as the first line of defence for both home and enterprise networks.
According to the ASUS Product Security Advisory, CVE-2026-13385 originates from improper validation of network communications within router management components. The flaw allows an attacker positioned between the router and a legitimate service — a classic man-in-the-middle position — to manipulate network traffic and inject arbitrary commands that the router executes without authorisation. Under certain conditions, this extends to unauthenticated remote command execution, meaning the attacker does not need valid router credentials to carry out a successful exploit.
Successful exploitation can result in complete device compromise, traffic interception and surveillance, DNS hijacking — redirecting users to malicious destinations — lateral movement into connected internal networks, and potential recruitment of the router into large-scale botnets used for DDoS attacks or as covert proxy infrastructure. Security researchers note that MITM-based exploitation significantly lowers the barrier for attackers operating on compromised or untrusted networks such as public Wi-Fi hotspots or scenarios involving ISP-level interception — environments where routers are particularly exposed to positioned adversaries.
ASUS routers are widely deployed across both home environments and small-to-medium enterprise networks globally. The breadth of the affected firmware versions — spanning three distinct branches — means a substantial number of devices are potentially vulnerable. Routers occupy a uniquely privileged position in network infrastructure, managing all inbound and outbound traffic, DNS resolution, and gateway functions. A successfully compromised router gives an attacker a persistent vantage point that is difficult to detect and from which they can observe or manipulate all traffic passing through the device. In enterprise settings, a compromised gateway router also provides a foothold for lateral movement toward internal systems that would otherwise be inaccessible from the public internet.
Security researchers additionally warn that router vulnerabilities of this class are frequently incorporated into automated scanning and exploitation campaigns shortly after public disclosure, as botnet operators monitor vulnerability feeds and attempt mass exploitation against unpatched devices exposed to the internet.
ASUS has released patched firmware that resolves CVE-2026-13385 and several related vulnerabilities. The immediate priority for all users is to upgrade to the latest firmware using the ASUS router administration interface or download portal. Beyond patching, ASUS and security researchers advise disabling remote administration features if they are not actively needed, enforcing strong and unique administrative credentials, restricting management interface access to trusted IP ranges only, and monitoring for unusual DNS configuration changes, unauthorised router configuration modifications, and abnormal outbound traffic patterns that could indicate a compromise has already occurred. For higher-risk environments, implementing network segmentation can limit the blast radius if the router is compromised.
ASUS confirmed it adheres to Coordinated Vulnerability Disclosure practices and participates in global security frameworks including ISO 29147:2018 and ISO 30111:2019, as a CVE Numbering Authority and member of FIRST. The company aims to acknowledge vulnerability reports within three business days and maintain ongoing remediation updates through its Product Security Incident Response Team.