SQL Injection in ASUS Router

CVE-2026-11851

Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certain ASUS router models allows a remote authenticated user to disclose confidential information via a crafted request that bypasses existing input validation Refer to the '  Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

Vulnerability class: SQL Injection

EPSS: 0.005 (40.6th percentile) — read the EPSS interpretation.

Affected products

  • Asus Router — versions ASUSWRT 3.0.0.4_386 series, ASUSWRT 3.0.0.4_388 series, ASUSWRT 3.0.0.6_102 series

Weakness classification (CWE)

References