CVE-2025-59370

HIGH

ASUS Router 3.0.0.4_386 3.0.0.4_388 3.0.0.6_102 - Authenticated OS Command Injection in bwdpi

Title source: llm
STIX 2.1

Description

A command injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbitrary commands, leading to the device executing unintended instructions. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

References (1)

Core 1
Core References
Various Sources vendor-advisory
https://www.asus.com/security-advisory/

Scores

CVSS v4 7.5
EPSS 0.0026
EPSS Percentile 49.3%
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (3)
ASUS/Router 3.0.0.4_386
ASUS/Router 3.0.0.4_388
ASUS/Router 3.0.0.6_102
Published Nov 25, 2025
Tracked Since Feb 18, 2026