CVE-2025-15101CWE-78

An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrators to execute…

High · published March 26, 2026

CVSS v4.0
8.6
EPSS
1%
Percentile
59.2
In the wild
Unconfirmed
What it is

An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrators to execute arbitrary system commands via a crafted parameter.

Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00899 · 59.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-03-26T02:01Z
EPSS history
Timeline
  • 26 MAR 02:01Z
    An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrators to execute…
    cvelistv5