- ASUS Patches CVE-2025-593656, a Critical Authentication Bypass Flaw in AiCloud-Enabled Routers
- Vulnerability allows unauthorized RCE; users are encouraged to update firmware or disable risky services
- Update fixes nine bugs overall, highlighting routers as prime cyber attack targets
Asus has fixed a critical-level vulnerability in its router firmware that could be used in Remote Code Execution (RCE) attacks. Given the potential risk, users are advised to apply the fix immediately.
In a security advisory released, Asus said it fixed CVE-2025-593656, a critical authentication bypass vulnerability that affects the AiCloud remote access/cloud feature found on certain routers.
The problem stems from its interaction with the Samba file sharing code, which was broken and allowed unauthorized attackers to run OS commands without valid credentials.
Qilin takes the blame
The bug was given a severity score of 9.2/10 (Critical) and affects these firmware versions:
3.0.0.4_386
3.0.0.4_388
3.0.0.6_102
It is difficult to determine an exact list of affected models, but in general, any Asus router that includes and enables AiCloud while running the affected firmware versions is potentially vulnerable. This also includes routers that reached end-of-life status.
Users should apply the fix as soon as possible or alternatively disable AiCloud, Samba/file sharing, remote WAN access, port forwarding and other Internet-facing services. It is also recommended to update the admin password and WiFi password to something stronger,
Although it is definitely the most dangerous, this is not the only bug that Asus addresses in this security update. According to the advisory, a total of 9 vulnerabilities were addressed this time, with the majority having a medium or high severity level.
Since the router is the gateway to all data passing through a network, the router is the primary target of many cyber attacks. Asus is one of the world’s most popular hardware manufacturers, whose devices are often abused, which is why patching is considered essential. In April of this year, the company fixed a separate, critical authentication bypass bug that also affected routers with AiCloud enabled.
Furthermore, recent reports said that cybercriminals involved in the WrtHug attacks also exploited vulnerabilities found in ASUS routers.
Via Bleeping Computer
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews and opinions in your feeds. Be sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, video unboxings, and get regular updates from us on WhatsApp also.
