Trending Articles
Trending Topics
Trending
ASUS has urged users to apply security updates to its laptops, PCs and routers, as the hardware giant once again has to deal with multiple vulnerabilities in its products. Hot on the heels of Operation WrtHug, described as “a massive, coordinated effort that has compromised thousands of ASUS routers worldwide,” comes the news of yet more vulnerabilities. One of which has a severity rating of 9.4 on the Common Vulnerability Scoring System (CVSS).
The vulnerabilities cover router hardware and computer software. All the vulnerabilities, including those covered by Operation WrtHug, have now been patched, with ASUS confirming the latest updates in security advisories released this week.
The first advisory concerns firmware across a number of ASUS routers. See below for the full list:
All the above firmware series are susceptible to multiple vulnerabilities. The most critical, that with the CVSS 9.4 rating, is CVE-2025-59366, an authentication bypass vulnerability in AiCloud that could lead to the “execution of specific functions without proper authorisation”.
If that sounds bad, it’s because it is. Very bad indeed. “ASUS strongly recommends that all users update their router firmware to the latest version immediately,” the advisory warned.
Which is easier said than done when your router has reached end-of-life, of course, as these are unsupported and therefore aren’t given firmware updates. ASUS suggests that in this case users should “ensure that both your router login and WiFi passwords are strong and unique,” while at the same time disabling any services that are accessible from the internet.
Great advice there. Not! How about just buying a new router instead, if you want to still be able to actually use it?
The second advisory is a software one, but nonetheless important as the software concerned is MyASUS. Yes, the very same one that’s preinstalled on your ASUS computer to provide access to support tools and, the irony, system updates.
The vulnerability in question impacts the System Control Interface Service of MyASUS, and could enable an attacker with low privileges to escalate these and execute arbitrary files as SYSTEM.
ASUS has confirmed that the vulnerability and the security update apply to “all personal computers, including desktop, laptop, NUC, and All-in-One PC”.
It goes without saying, but here I am saying it anyway, you should go visit the Asus support site and download the necessary security updates as a matter of some urgency.
