# CVE-2026-13385: ASUS Router remote command execution via improper certificate validation

Source: https://junglewise.ai/threats/cve-2026-13385-asus-router-remote-command-execution-via-improper-certificate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-13385 · Severity: info · CVSS 9.5 · Published 2026-07-15

A security vulnerability exists in several ASUS router models that could allow an attacker to take complete control of the device. By intercepting the router's communication, an attacker can trick the device into downloading and running malicious commands from a fake server. This could lead to the theft of personal data, monitoring of internet traffic, or a total loss of network security for the home or business.

Technologies: [ASUS Router Firmware](https://junglewise.ai/threats/technologies/router-firmware). Vendors: [ASUS](https://junglewise.ai/threats/vendors/asus).

## Quick answers

**Is CVE-2026-13385 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13385 being exploited in the wild.

**How severe is CVE-2026-13385?** Informational severity, with a CVSS score of 9.5, published 15 July 2026.

**Which products and versions are affected?** ASUS Router Firmware 3.0.0.4_386 series; ASUS Router Firmware 3.0.0.4_388 series; ASUS Router Firmware 3.0.0.6_102 series.

**Is there a fix for CVE-2026-13385?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-13385 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-13385?** Check whether you run ASUS Router Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from Improper Certificate Validation (CWE-295) and Improper Validation of Integrity Check Value (CWE-354) within the firmware update or communication modules of affected ASUS routers. A remote attacker positioned as a man-in-the-middle (MITM) can bypass security checks by using a spoofed server. Because the router fails to properly verify the server's identity and the integrity of the downloaded data, the attacker can force the device to download and execute arbitrary commands with high privileges. The vulnerability affects firmware versions in the 3.0.0.4_386, 3.0.0.4_388, and 3.0.0.6_102 series.

## Affected products

- ASUS Router Firmware 3.0.0.4_386 series
- ASUS Router Firmware 3.0.0.4_388 series
- ASUS Router Firmware 3.0.0.6_102 series

## Timeline

- 2026-07-14: disclosed: CVE record published by ASUS
- 2026-07-15: advisory: NVD publication date

## References

- [https://www.asus.com/security-advisory/](https://www.asus.com/security-advisory/)

## Related threats

- [ASUS Router firmware OS command injection](https://junglewise.ai/threats/cve-2026-88710-improper-neutralization-of-special-elements-used-in-an-os-command)
- [ASUS Router firmware command injection via USB device](https://junglewise.ai/threats/cve-2026-88709-improper-neutralization-of-special-elements-used-in-an-os-command)
- [ASUS Router firmware off-by-one error in packet handling](https://junglewise.ai/threats/cve-2026-88708-an-off-by-one-error-in-certain-asus-router-firmware-allows-an)
- [ASUS Router firmware out-of-bounds write vulnerability](https://junglewise.ai/threats/cve-2026-88707-an-out-of-bounds-write-in-certain-asus-router-firmware-allows-an)
- [ASUS Router stack-based buffer overflow in AiCloud](https://junglewise.ai/threats/cve-2026-84730-stack-based-buffer-overflow-in-certain-asus-router-firmware)