# CVE-2026-75775: CVE-2026-75775

Status: published. Published: 2026-10-23. Updated: 2026-11-02.

Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- ASUS / Router: 3.0.0.6.102 series (affected, custom); 3.0.0.4.386 series (affected); 3.0.0.4.388 series (affected). Source: CNA: ASUS

## Severity and prioritization

- CVSS 4.0: 7.7 (high); CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; source: CNA: ASUS

- CVSS 4.0: 7.7 (high); CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: 54bf65a7-a193-42d2-b1ba-8e150d3c35e1

- CISA KEV: No listing in collected sources

- EPSS: 0.60% as of 2026-11-01; percentile 48.96%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-78

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.asus.com/security-advisory (CNA: ASUS)

- https://www.asus.com/security-advisory (54bf65a7-a193-42d2-b1ba-8e150d3c35e1)

## Provenance

- CNA: ASUS: https://www.cve.org/CVERecord?id=CVE-2026-75775; retrieved 2026-11-02; source updated 2026-11-02

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-75775; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-75775; retrieved 2026-11-02; source updated Not reported

Revision: c4b326442a4d041d6de152b5e01d300cc8d2db38ed3f520626c17d5a2959e40a

Canonical: https://y2.dev/cve/CVE-2026-75775