ASUS has issued router firmware fixes for CVE-2026-14157, a flaw rated 9.4 out of 10 on the CVSS version 4.0 scale that lets an attacker run commands on the device by getting a specially crafted VPN client configuration file loaded. A second flaw, CVE-2026-13313, scored 8.9 and was fixed alongside it. The bulletins were last updated on October 1, 2026.
The 9.4 is a measure of technical severity, not a forecast of attacks. The precondition matters more than the number: this is not a bug that can be reached by scanning the internet for exposed routers. A flaw that requires a victim to import a malicious file, through an authenticated session, belongs in a different risk category from one that needs nothing but an open port, even when both receive a similar score. Readers who manage a home or small-office router should treat it as a prompt to check firmware, not as evidence of an active campaign.
The 9.4 flaw and the VPN file that triggers it
CyberInsider’s report on the ASUS bulletins describes CVE-2026-14157 as a critical flaw in the router’s web management interface, scored 9.4 on CVSS v4.0. The weakness lets an attacker execute commands once a specially crafted VPN client configuration file is uploaded. Router VPN client features exist so a home or office network can connect outward to a commercial or private VPN provider, and they accept configuration files in standard formats. A file that appears to be an ordinary connection profile is the delivery vehicle here, which makes the weakness a parsing and trust problem rather than a password problem.
Command execution on a router is a serious outcome because the device sits between every phone, laptop and television in a building and the internet. Code running there can in principle watch or redirect traffic, change DNS settings or serve as a foothold for reaching other devices on the local network. The report does not describe what an attacker did or could do after execution beyond the ability to run commands, and the severity score itself is defined by the scoring system rather than by any observed incident. The scoring framework is documented by FIRST, the organization that maintains CVSS.
Authenticated access separates this from an internet-facing hole
According to the report, the attacker in CVE-2026-14157 is authenticated: the crafted file has to be uploaded through the management interface, which means someone with a valid session must be tricked or already be in place. That is the line between this flaw and a remotely exploitable bug in an internet-facing service, where no login or user action is needed. The practical attack story is social engineering. A victim, typically the person administering the router, is persuaded to import a VPN profile from an untrusted source, such as a file passed around as a free or convenient configuration.
CVE-2026-13313, the 8.9 flaw, also involves an authenticated remote attacker, and the report lists it as a high-severity issue in the router firmware. Details of its mechanism are thinner than those for the 9.4 flaw. Both entries can be looked up in the National Vulnerability Database, which carries records for CVE-2026-14157 and CVE-2026-13313. The report does not say which body assigned the scores, and it states plainly that neither router bulletin says whether the flaws have been exploited in attacks.
Firmware branches and the update path
The affected firmware is identified by branch. CVE-2026-14157 applies to the 3.0.0.6_102 series. CVE-2026-13313 applies to three series: 3.0.0.4_386, 3.0.0.4_388 and 3.0.0.6_102. The report does not give router model names, and it does not state the fixed firmware version number, so owners need to read the ASUS security advisory page and the support page for their exact model to see which build replaces theirs.
The report says ASUS urges users to install the latest firmware immediately. Until a router is patched, its advice is to import VPN configuration files only from trusted sources and to avoid public, unknown or unverifiable files. It also recommends strong, unique admin passwords of at least 10 characters mixing uppercase letters, numbers and symbols, and warns against running untrusted scripts, tools or commands on devices on the local network.
Some routers no longer receive updates, and the report points readers to ASUS’s end-of-life list. For those models, the same password hygiene reduces exposure, but it does not patch either vulnerability. Replacing an unsupported router is the only route to a fixed firmware branch.
The same bulletin set also covered a motherboard BIOS flaw, CVE-2026-93495, scored 7.0 and requiring physical access, which is unrelated to the router fixes and carries a different risk profile. Per the report, the affected boards are in the Z390 and C246 families, with fixed BIOS version 2203 for most of them and 1502 for the WS Z390 PRO. Anyone running one of those boards needs the BIOS update for the exact model, which is a separate download from router firmware and a separate task entirely from anything involving a VPN file.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- NOAA now gives this winter a 75% chance of the strongest El Nino since 1950
- Doctors warn a silent liver disease now affects one in three American adults
- The FBI told the rest of ShinyHunters to surrender after a 24-year-old was arrested
- Two passengers died at an Ohio toll plaza, and the NTSB now wants the cash lanes shut
