Asus has released security patches for its routers to address two critical vulnerabilities. The first flaw, identified as CVE-2026-14157, received a CVSS 4.0 score of 9.4. It stems from the VPN client configuration file import feature in the web interface, allowing arbitrary command execution if a malicious file is uploaded.
The second vulnerability, CVE-2026-13313, is rated 8.9 and involves leftover debug code in the firmware. This issue allows attackers to bypass security checks, enable Telnet, and gain root-level access to the device. Such access grants full control over the router and facilitates further attacks on the local network.
The first issue affects firmware builds version 3.0.0.6_102. The Telnet-related vulnerability impacts versions 3.0.0.4_386 and 3.0.0.4_388. Asus advises users to install the latest firmware updates immediately and to import VPN profiles only from trusted sources.
The company also recommends setting a unique administrative password of at least 10 characters, including mixed-case letters, numbers, and symbols. Users are warned against running unknown scripts on their home networks. Devices that no longer receive official support will remain vulnerable to these specific flaws.
