CVE-2025-59371

HighCVSS 7.5/10Last modified Oct 18, 2026

Description

An authentication bypass vulnerability has been identified in the IFTTT integration feature. A remote, authenticated attacker could leverage this vulnerability to potentially gain unauthorized access to the device. This vulnerability does not affect Wi-Fi 7 series models. Refer to the 'Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.

Metrics

CVSS 4.0 7.5/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-330

Affected software

No affected versions have been published.

Timeline

Published: Nov 25, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-593726.9A path traversal vulnerability has been identified in certain router models. A remote, authenticated attacker could exploit this vulnerabili CVE-2025-593738.5A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when a CVE-2025-593749.8"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced thro CVE-2025-593757.5libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsi CVE-2025-593765.3feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-dele CVE-2025-593779.8feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is us CVE-2025-593785.7In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program that allows a regular CVE-2025-593797.5DwyerOmega Isensix Advanced Remote Monitoring System (ARMS) 1.5.7 allows an attacker to retrieve sensitive information from the underlying S CVE-2025-59384.3The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all vers CVE-2025-593804.9A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrat CVE-2025-593814.9A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrat CVE-2025-593821.2QTS, QuTS hero, QuTScloud are not affected. We have already fixed the vulnerability in the following version: