What is CVE-2025-2492?

CVE-2025-2492 is a vulnerability in Asus Router, classified under Authentication Bypass Using an Alternate Path or Channel. Published 2025-04-18.

Is CVE-2025-2492 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Asus Router

CVE-2025-2492

An improper authentication control vulnerability exists in AiCloud. This vulnerability can be triggered by a crafted request, potentially leading to unauthorized execution of functions. Refer to the 'ASUS Router AiCloud vulnerability' section on the ASUS Security Advisory for more information.

EPSS: 0.013 (67.2th percentile) — read the EPSS interpretation.

Affected products

Asus Router — versions 3.0.0.4_382 series, 3.0.0.4_386 series, 3.0.0.4_388 series

Weakness classification (CWE)

CWE-288 — Authentication Bypass Using an Alternate Path or Channel

Public proof-of-concept exploits

References

54bf65a7-a193-42d2-b1ba-8e150d3c35e1 (vendor-advisory)

Frequently asked questions

What is CVE-2025-2492?: CVE-2025-2492 is a vulnerability in Asus Router, classified under Authentication Bypass Using an Alternate Path or Channel. Published 2025-04-18.
Is CVE-2025-2492 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.