CVE-2025-59366criticalCWE-22CWE-78

CVE-2025-59366: critical vulnerability in ASUS Router

Published · Updated

Follow this CVE+ Monitor Router

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.2epss 12%
In short

A flaw in AiCloud allows attackers to skip authentication checks due to how Samba is configured, letting them run commands they shouldn't have access to. This puts your router and files at serious risk.

Technical detail

An authentication bypass exists in AiCloud stemming from Samba functionality misconfiguration (CWE-22, CWE-78), enabling unauthorized execution of privileged functions without proper credential validation. The vulnerability allows attackers to circumvent access controls and potentially achieve command execution on affected ASUS router systems.

Summary generated and translated by AI from the official description.
An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba functionality, potentially leading to allow execution of specific functions without proper authorization. Refer to the Security Update for ASUS Router Firmware section on the ASUS Security Advisory for more information.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
ASUS · Router
Related CVEs — ASUS Router

In the same product, most dangerous first.

CVE-2024-12912HIGHCVE-2024-12912EPSS 1.2%CVE-2026-75779HIGHCVE-2026-75779EPSS 1.2%CVE-2025-2492CRITICALCVE-2025-2492EPSS 1.1%CVE-2024-13062HIGHCVE-2024-13062EPSS 1.0%CVE-2025-59370HIGHCVE-2025-59370EPSS 1.0%CVE-2025-15101HIGHCVE-2025-15101EPSS 0.9%