CVE-2026-84729 in ASUS
Summary
by MITRE • 11/04/2026
Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intended buffer or potentially cause a denial-of-service (DoS) via a crafted packet. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability described constitutes an out-of-bounds write flaw within specific firmware versions of ASUS routers, representing a critical security deficiency that compromises the integrity and availability of network infrastructure. This type of memory corruption error occurs when software writes data to a buffer beyond its allocated boundaries, potentially overwriting adjacent memory structures or executing arbitrary code depending on the context. In this instance, the vulnerability is triggered by processing crafted network packets, which allows an attacker who has physical proximity to the target device to exploit the flaw without requiring any form of authentication. The absence of required credentials significantly lowers the barrier for entry, enabling individuals with local access to the wireless or wired network segment to initiate malicious payloads against vulnerable devices.
From a technical perspective, out-of-bounds writes are particularly dangerous because they can lead to heap corruption, stack smashing, or control flow hijacking. When an attacker sends a specially constructed packet containing malformed data fields, the router's firmware fails to properly validate input lengths or bounds before processing them. This lack of rigorous boundary checking allows malicious data to spill over into adjacent memory regions. Depending on how the affected buffer is situated within the device's memory layout, this overflow can corrupt critical system structures such as function pointers, return addresses, or security cookies. Such corruption creates opportunities for remote code execution, where an attacker gains full control over the router’s operating environment, effectively turning the device into a compromised node within the network topology.
The operational impact of this vulnerability extends beyond simple data manipulation to include severe denial-of-service conditions. Even if successful exploitation does not immediately result in arbitrary code execution, the memory corruption can destabilize the firmware's runtime state. This instability often manifests as system crashes, reboots, or unresponsive network interfaces, thereby disrupting connectivity for all devices relying on the compromised router. For enterprise environments or critical infrastructure utilizing ASUS routers, such disruptions can lead to significant downtime and operational paralysis. Furthermore, if an attacker achieves code execution through this vulnerability, they could establish persistent backdoors, intercept sensitive traffic via man-in-the-middle attacks, or pivot into internal networks that were previously considered secure behind the firewall perimeter.
This flaw aligns with Common Weakness Enumeration identifier CWE-787, which specifically categorizes out-of-bounds writes as a critical memory safety violation. It also maps to MITRE ATT&CK techniques related to initial access and privilege escalation, particularly those involving exploitation of software vulnerabilities for remote code execution. The attack vector is classified as network-based with local proximity requirements, indicating that while the vulnerability can be exploited remotely over IP networks, it typically requires the attacker to be within range of the wireless signal or connected to the same physical LAN segment unless other misconfigurations expose management interfaces externally.
Mitigation strategies must prioritize immediate firmware updates provided by ASUS in their security advisories, as these patches include bounds checking improvements and input validation fixes that address the root cause of the memory corruption. Organizations should verify the current firmware version against known vulnerable lists and apply updates during maintenance windows to minimize disruption. In environments where patching is not immediately feasible, network segmentation can help isolate vulnerable devices from critical assets, reducing the blast radius in case of exploitation. Additionally, implementing strict access control policies on management interfaces and disabling unnecessary services reduces the attack surface available to potential adversaries. Continuous monitoring for anomalous traffic patterns indicative of fuzzing or exploit attempts can also aid in early detection and response efforts.