CVE-2025-59366

CriticalCVSS 9.2/10Last modified Oct 18, 2026

Description

An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba functionality, potentially leading to allow execution of specific functions without proper authorization.

Refer to the Security Update for ASUS Router Firmware section on the ASUS Security Advisory for more information.

Metrics

CVSS 4.0 9.2/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-22 CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Nov 25, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-593679.8An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized ac CVE-2025-593686.0An integer underflow vulnerability has been identified in Aicloud. An authenticated attacker may trigger this vulnerability by sending a cra CVE-2025-593695.9A SQL injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentiall CVE-2025-59374.3The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Reques CVE-2025-593707.5A command injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potent CVE-2025-593717.5An authentication bypass vulnerability has been identified in the IFTTT integration feature. A remote, authenticated attacker could leverage CVE-2025-593726.9A path traversal vulnerability has been identified in certain router models. A remote, authenticated attacker could exploit this vulnerabili CVE-2025-593738.5A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when a CVE-2025-593749.8"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced thro CVE-2025-593757.5libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsi CVE-2025-593765.3feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-dele CVE-2025-593779.8feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is us