PoC forges administrator ticket on ASUS routers
CVE-2026-93489 in ASUS router firmware modules allows an unauthenticated nearby user to send an HTTP request, forge an access ticket, and perform administrator operations. A proof of concept has been disclosed, according to dbugs. ASUS router owners should check the "Security Update for ASUS Router Firmware" section of the ASUS Security Advisory and update the firmware.
What happened
An authentication flaw in ASUS routers lets a nearby user, without login, forge an access ticket and run administrator operations on the device. A proof of concept has been publicly disclosed.
Why it matters
The router is the network gateway; whoever controls it with administrator privileges can manipulate the connected network. With a public PoC, the effort to exploit the flaw drops, and unupdated devices stay exposed.
What to do
Check the "Security Update for ASUS Router Firmware" section of the ASUS Security Advisory and install the firmware version indicated for the router. Review the vendor update center as a priority.
For the technical team
- CVE
- CVE-2026-93489
- Affected
- Roteadores ASUS (módulos do firmware) · ASUS router modules; versions not specified in the source.
- Exploitation
- PoC/exploit disclosed, reported by dbugs (PT ID PT-2026-121783). No in-the-wild exploitation reported in the sources.
- Fix
- Source directs to the "Security Update for ASUS Router Firmware" section of the ASUS Security Advisory. Fixed versions not specified.
- Vector
- Improper authentication in ASUS router modules. An unauthenticated nearby user sends an HTTP request and forges an access ticket, enabling administrator operations. Exploitation requires proximity to the router, no credentials needed.
- More details
- CVE-2026-93489. Disclosure recorded by dbugs, which references the official ASUS security advisory as the update channel.
Timeline
A proof of concept for CVE-2026-93489 was released.
Sources 1 source
- @ptdbugs @ptdbugs
