CVE-2026-84730

HighCVSS 8.7/10Last modified Nov 12, 2026

Description

Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with root privileges via a crafted device name. Refer to the ' Security Update for ASUS Router AiCloud Feature ' section on the ASUS Security Advisory for more information.

Metrics

CVSS 4.0 8.7/10

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-121

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
ASUS	Router firmware	ASUSWRT 3.0.0.4_386 series; ASUSWRT 3.0.0.4_388 series; ASUSWRT 3.0.0.6_102 series

References

https://www.asus.com/security-advisory

Timeline

Published: Nov 4, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-847319.8An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element b CVE-2026-847328.7Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via CVE-2026-847349.8The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own CVE-2026-847368.3In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables CVE-2026-847379.8The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthent CVE-2026-847389.1The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing us CVE-2026-847398.7GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 t CVE-2026-84745.3A vulnerability was discovered on Stormshield Network Security * 4.3.0 to 4.3.41, * 4.8.0 to 4.8.15, * 5.0.0 to 5.0.5 CVE-2026-847406.5The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before m CVE-2026-847415.3The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details in CVE-2026-847422.7The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it CVE-2026-847433.8The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, al