← Back to CVE List
CVE-2026-11851NVD
Vulnerability Summary
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certain ASUS router models allows a remote authenticated user to disclose confidential information via a crafted request that bypasses existing input validation
Refer to the '
Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
Refer to the '
Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
CVSS v4.0 Base Metrics — Score 5.9 (MEDIUM)
Attack VectorNetwork
Attack ComplexityHigh
Attack RequirementsNone
Privileges RequiredHigh
User InteractionNone
Confidentiality (Vulnerable System)High
Integrity (Vulnerable System)None
Availability (Vulnerable System)None
Confidentiality (Subsequent System)None
Integrity (Subsequent System)None
Availability (Subsequent System)None
Affected & Patched Versions
- ASUS Router >= ASUSWRT 3.0.0.4_386 series
- ASUS Router >= ASUSWRT 3.0.0.4_388 series
- ASUS Router >= ASUSWRT 3.0.0.6_102 series
Not provided by cveorg for this CVE.