ASUS patched three router flaws on Friday and did not say which routers

ASUS posted a bulletin called Security Update for ASUS Router Firmware on Friday 23 October. Three flaws, all rated High, all in the 3.0.0.6_102 firmware line, which is the one running on its newer Wi-Fi 7 and ZenWiFi hardware.

The one to care about is CVE-2026-93489, scored 8.7. An attacker on an adjacent network sends an HTTP request, forges an access ticket, and from that point performs administrator operations on the router. No password, no login. Adjacent network means somebody already inside your Wi-Fi's reach rather than anywhere on the internet, so the realistic version of this is a neighbour, a visitor who once had the guest password, or a cheap smart plug that has itself been taken over. The other two need a bit more luck: CVE-2026-75775 at 7.7 runs commands as root but only while the router is still in its factory default state, and CVE-2026-75779 at 8.6 needs you to be logged into the admin page and then visit a malicious site in another tab. Nobody has reported any of them being used yet.

What ASUS did not publish is a list of affected models, which makes this more annoying than it should be. The practical route is to open your router's admin page, look at the firmware version, and compare it with whatever is offered on the ASUS support page for your model. If it is newer, install it. If you cannot update immediately, ASUS suggests the sensible fallbacks: a router admin password and a Wi-Fi password of at least ten characters, remote access from the internet turned off, and a look through the list of linked devices and app sessions for anything you do not recognise.

This is ASUS's third router advisory this month, after ones on the 7th and the 20th, which tells you something about how often these things need checking. Tendvane's Network scan lists everything currently connected to your Wi-Fi, which is usually how an unfamiliar device gets noticed in the first place.