Asus has released firmware updates to address two critical vulnerabilities in its routers, identified as CVE-2026-14157 and CVE-2026-13313. These flaws received CVSS scores of 9.4 and 8.9 out of 10, respectively. The issues affect firmware series 3.0.0.6_102, with the Telnet-related bug also impacting the 3.0.0.4_386 and 3.0.0.4_388 series.
The VPN configuration vulnerability occurs when the router processes malicious text within uploaded files as formatting instructions. A separate flaw allows a logged-in attacker to enable Telnet with root access. Asus warns that routers which have reached their end-of-life status will not receive these security patches.
In addition to router fixes, Asus addressed a high-severity vulnerability in 13 motherboard models, including Z390 and C246 series. Rated 7.0 on the CVSS scale, this flaw allows a physically proximate attacker to read or write system memory via a malicious device. The company issued BIOS version 1502 for the WS Z390 Pro and 2203 for the other affected boards.
To mitigate risks, Asus advises users to import VPN files only from trusted sources and to set strong, unique administrative passwords of at least 10 characters. The company also recommends avoiding the execution of untrusted scripts or commands on local network devices to prevent potential exploitation through social engineering.
