# CVE-2026-93489: CVE-2026-93489

Status: published. Published: 2026-10-23. Updated: 2026-11-02.

Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations.
Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- ASUS / Router: 3.0.0.6_102 series (affected, custom); 3.0.0.4.388 series (affected, custom); 3.0.0.4.386 series (affected, custom). Source: CNA: ASUS

## Severity and prioritization

- CVSS 4.0: 8.7 (high); CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; source: CNA: ASUS

- CVSS 4.0: 8.7 (high); CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: 54bf65a7-a193-42d2-b1ba-8e150d3c35e1

- CISA KEV: No listing in collected sources

- EPSS: 0.23% as of 2026-11-01; percentile 14.02%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-287

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.asus.com/security-advisory (CNA: ASUS)

- https://www.asus.com/security-advisory (54bf65a7-a193-42d2-b1ba-8e150d3c35e1)

## Provenance

- CNA: ASUS: https://www.cve.org/CVERecord?id=CVE-2026-93489; retrieved 2026-11-02; source updated 2026-11-02

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-93489; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-93489; retrieved 2026-11-02; source updated Not reported

Revision: 0a03159d40d2d194207f50fce05c3a494b2d227645cfc86ff777894c07a65ce2

Canonical: https://y2.dev/cve/CVE-2026-93489