Asus Patches Two Critical Router Flaws, 13 Motherboards
Asus fixed two critical router bugs, rated 9.4 and 8.9, plus a high-severity flaw affecting 13 motherboard models.
Asus has released firmware updates to fix two critical security flaws in its routers, alongside a high-severity fix for 13 motherboard models.
The more severe router bug, CVE-2026-14157, is rated 9.4 on the CVSS 4.0 scale. It allows arbitrary command execution through a crafted VPN client configuration file uploaded via the router's web management interface. The second flaw, CVE-2026-13313, is rated 8.9 and lets an attacker enable Telnet and potentially run commands with root privileges.
The affected firmware series are 3.0.0.6_102 for both bugs, and 3.0.0.4_386 and 3.0.0.4_388 for the Telnet flaw.
Motherboard fix
Asus also patched a high-severity flaw in 13 motherboard models, including Z390 and C246 boards, that could allow a physically proximate attacker to read or write arbitrary system memory. The fix is BIOS version 1502 for the WS Z390 Pro and 2203 for the other 12 boards.
The router flaws follow earlier router security trouble. In 2024, VulnCheck disclosed CVE-2024-0401, a flaw using a crafted OVPN profile that exploited the same entry point as the VPN bug. Separately, the AyySSHush campaign used authentication bypasses, brute-force logins, and CVE-2023-39780 to backdoor over 9,000 routers, with a backdoor that could survive firmware updates.
Quick answers
What are the two critical Asus router vulnerabilities?
CVE-2026-14157 allows arbitrary command execution via a crafted VPN client configuration file, and CVE-2026-13313 allows an attacker to enable Telnet and potentially run commands with root privileges.
Which Asus firmware versions are affected?
Firmware series 3.0.0.6_102 is affected by both bugs, while 3.0.0.4_386 and 3.0.0.4_388 are affected by the Telnet flaw.
Which motherboards got the BIOS fix?
13 models, including Z390 and C246 boards. The fix is BIOS version 1502 for the WS Z390 Pro and 2203 for the other 12 boards.