RCE in ASUS Router

CVE-2025-59366

An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba functionality, potentially leading to allow execution of specific functions without proper authorization. Refer to the Security Update for ASUS Router Firmware section on the ASUS Security Advisory for more information.

Vulnerability class: Path Traversal (Directory Traversal)

Published · last modified .

EPSS exploit prediction

EPSS: 0.158 (96.8th percentile), scored .

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 96.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2025-59366: held from 0.158 to 0.158.

EPSS over last 30 days · oldest: 0.158 · newest: 0.158 · change: 0.000

Affected products

  • ASUS Router — versions 3.0.0.4_386, 3.0.0.4_388, 3.0.0.6_102

Weakness classification (CWE)

References