ASUS PATCHES A 9.2-classified security error in certain routers The error derives from Aicloud, a personal cloud server function There are no signs of abuse yet but users need to be careful
ASUS has released a solution for a vulnerability of critical difficulty that affects routers with Aicloud enabled, which could allow threat players to perform functions on the exposed units external and without permission.
It is traced as CVE-2025-2492 and got a severity of 9.2/10 (critical). It can be utilized through a specially-tailored request.
“This vulnerability can be triggered by a designed request that could potentially lead to unauthorized performance of functions,” the NVD side reads.
The protection of the device
Aicloud is a feature integrated into many ASUS routers that transform the home network into a personal cloud server.
Users can then access, stream, sync and share files stored on USB drives connected to the router anywhere with an Internet connection.
The error was found in firmwar versions released after February 2025, which means: 3.0.0.4_382, 3.0.0.4_386, 3.0.0.4_388 and 3.0.0.6_102.
According to cyberin pages “such features” often attractive targets “for threat actors become as they postpone sensitive data to the Internet.
Therefore, it would be wise not to delay the implementation of the patch. Depending on the model, there are different firmware versions that can be downloaded directly from the ASUS website.
The error also affects a few devices that reached out of life that should now have Aicloud completely disabled. Internet access for WAN should also be disabled as well as port shipping, DDNS, VPN Server, DMZ, Port Triggering and FTP Services.
The company did not say if the error is abused in nature or not, but at press time it was not added Cisa’s Kev, which is usually a good litmus paper for actively exploited deficiencies.
According to Bleeping computer The critical CVSS evaluation “involves utilization can have a significant influence.” Asus also asked its users to use unique, strong passwords to secure their wireless networks and router management pages.
This means making passwords at least 10 characters long and making them a mixture of lowercase and uppercase letters, numbers and special symbols.
You also like
