ASUS patches two flaws that turn a VPN profile into command execution

October 1, 2026. ASUS publishes CVE-2026-14157 and CVE-2026-13313, two flaws in its routers’ web admin interface, with fixed firmware available the same day. October 1, 2026. CISA enriches both entries: exploitation “none,” automatable “no,” technical impact “total.” 2024. A flaw of the same shape, CVE-2024-0401, already hit the very same VPN-profile import path. Why it matters: both flaws turn the router — the one device every other device on the network trusts — into a command-execution point, up to root.

A poisoned VPN profile

CVE-2026-14157 is rated CVSS 9.4, critical. It is a format-string flaw (CWE-134): text that should be treated as plain data is instead interpreted as formatting instructions by the router’s code.

The vector is concrete. Many ASUS routers can act as a VPN client, so every device on the network — TVs, consoles, printers — routes its traffic through a VPN provider. To set this up you download a configuration file, usually an OpenVPN .ovpn profile, and import it through the admin page. On recent firmware the feature is called VPN Fusion.

The flaw sits exactly there: in the way the router reads that imported file. A carefully constructed .ovpn file can abuse the format string to trigger arbitrary command execution on the router. Two details bound the scope: it applies to profiles imported into the router itself, not to VPN apps on a laptop or phone; and the upload happens through an authenticated admin session. The attacker must already hold the admin password — or talk someone who does into importing their file.

A forgotten Telnet door

CVE-2026-13313 is rated CVSS 8.9, high. It is a different kind of mistake, classed CWE-489, active debug code. Functionality meant for development stayed reachable in production firmware.

In practice, an authenticated attacker can send a crafted HTTP request to the admin interface that bypasses security checks and switches on Telnet — that old, unencrypted remote-access protocol — then use it to run commands with root privileges. The CVE record notes this can extend to other devices connected to the router.

Root on a router is total control: changing DNS settings to redirect traffic, capturing cleartext data, installing persistent malware, or using the router as a pivot into the internal network. This flaw also reaches further back than the first: it covers two older firmware series in addition to the current one.

Both scores stay high despite the authentication requirement, because both vectors rate impact as high not only on the router but on the systems connected to it. That is the point: the router is rarely the target; it is the way in.

Why “authentication required” does not reassure

It would be a mistake to read “admin access required” as “low risk.” Router admin passwords are often weak, left at defaults, reused, or shared among staff. Some organizations expose the admin page to the internet for convenience. A router compromised in the past may have left an attacker with still-valid credentials. And the VPN flaw needs only one administrator talked into importing one file. Any of those turns a post-authentication bug into a practical one.

ASUS does not list affected models by name: the advisory identifies devices by firmware series. The 3.0.0.4_386 and 3.0.0.4_388 series widen the pool exposed to CVE-2026-13313 well beyond recent hardware. And ASUS has said that end-of-life routers will not be patched: for those, replacement is the durable answer.

Routers already targeted by the thousands

The history leaves no room for comfort. CVE-2024-0401, disclosed by VulnCheck in 2024, was a command injection triggered through exactly the same entry point: a crafted OpenVPN profile imported via the admin page. Two separate bugs in the same import path within about two years: the code behind this feature deserves continued scrutiny.

The AyySSHush campaign, uncovered in 2025, combined authentication bypasses, brute force, and a command injection (CVE-2023-39780) to backdoor more than 9,000 ASUS routers, with persistence that survived firmware updates. A China-linked espionage operation separately hijacked more than 50,000 consumer ASUS routers last year, exploiting known bugs on old, unsupported devices to build a covert traffic-obfuscation network.

The AyySSHush case is the instructive one: brute-forced logins plus an authenticated command injection is precisely the combination these two new CVEs would slot into. Disclosure is when the clock starts, not when it stops.

What to do now

First, find the ASUS routers you depend on: at sites, in branches, and, where policy allows, in the homes of remote staff. Record the model and the firmware version shown on the admin page. A router that is not on an inventory is not being patched by anyone.

Second, update the firmware to the latest for each model, checking the firmware series against the “Security Update for ASUS Router Firmware” section of the ASUS advisory. For end-of-life routers the instruction is clear: replace them.

Third, harden what remains. Disable WAN-side admin access and limit the admin interface to a trusted network. Verify Telnet is off. Enforce a unique, strong admin password, and import VPN profiles only from the provider itself. If a router shows signs of compromise — unexpected Telnet on TCP port 23, unknown VPN profiles, changed DNS or forwarding settings, unfamiliar admin logins — do not simply update it: disconnect it, factory-reset it, install the latest firmware, and reconfigure it by hand, without restoring a saved configuration.

Verdict

Neither flaw is exotic. A format string and debug code left in production are both well-known, documented mistakes, and both live in the part of the router most exposed to its users: the admin page that parses files and requests from whoever is logged in. That this same VPN import path produced a serious bug in 2024 is a reminder that features which parse user-supplied files are where routers keep breaking.

If ASUS routers carry any of your business traffic, update the firmware this week, pull the admin page off WAN access, and switch Telnet off — this is a routine fix only as long as it is not yet an incident. If some devices are end-of-life, replace them rather than trust them. The deeper lesson is not about ASUS: a router that nobody owns, monitors, or updates is an entry point waiting to be used.

References

• InsomniSec — ASUS Router Flaws (CVE-2026-14157 and CVE-2026-13313): A Poisoned VPN File and a Forgotten Debug Switch (October 5, 2026)
• ThreatCluster — Asus Patches Critical Router Vulnerabilities Affecting VPN
• WindowsForum — Asus Router CVE-2026-14157 and CVE-2026-13313
• SentinelOne — CVE-2026-14157
• OpenCVE — CVE-2026-14157