# CVE-2026-75775: ASUS router command injection in factory-default state

Source: https://junglewise.ai/threats/cve-2026-75775-improper-neutralization-of-special-elements-used-in-an-os-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-75775 · Severity: info · Published 2026-10-23

A command injection vulnerability in certain ASUS routers allows a remote attacker to execute arbitrary commands with root-level privileges when the device is in its factory-default state. An attacker can exploit this through crafted parameters sent to the router, potentially gaining complete control of the device and the network it protects.

Technologies: [ASUS Router](https://junglewise.ai/threats/technologies/asus-router). Vendors: [ASUS](https://junglewise.ai/threats/vendors/asus).

## Quick answers

**Is CVE-2026-75775 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75775 being exploited in the wild.

**How severe is CVE-2026-75775?** Informational severity, published 23 October 2026.

**Which products and versions are affected?** ASUS Router certain models in factory-default state.

**Is there a fix for CVE-2026-75775?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-75775 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-75775?** Check whether you run ASUS Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability involves improper neutralization of special elements used in OS commands, allowing command injection through crafted parameters. The attack is network-accessible and requires the target router to be in factory-default state. Successful exploitation grants root-level code execution on the device.

## Affected products

- ASUS Router certain models in factory-default state

## Timeline

- 2026-10-23: disclosed

## References

- [https://www.asus.com/security-advisory](https://www.asus.com/security-advisory)

## Related threats

- [ASUS router OS command injection and CSRF in administrator interface](https://junglewise.ai/threats/cve-2026-75779-improper-neutralization-of-special-elements-used-in-an-os-command)
- [ASUS router missing authentication for critical function](https://junglewise.ai/threats/cve-2026-75753-missing-authentication-for-a-critical-function-in-certain-asus)
- [ASUS router sensitive information insertion into log file](https://junglewise.ai/threats/cve-2026-16528-insertion-of-sensitive-information-into-log-file-in-certain-asus)
- [ASUS Router format string in web management interface](https://junglewise.ai/threats/cve-2026-14157-use-of-an-externally-controlled-format-string-in-the-asus-router)