GoKawiilAsus patches two critical router firmware flaws tied to VPN config files
Asus has issued firmware updates for two critical vulnerabilities affecting its routers. One, CVE-2026-14157 (CVSS 9.4), lets an attacker who uploads a crafted VPN client configuration file through the router's web interface execute arbitrary commands. The other, CVE-2026-13313 (CVSS 8.9), exploits leftover debug code to bypass security checks, enable Telnet, and potentially run commands with root privileges, affecting firmware series 3.0.0.6_102, 3.0.0.4_386 and 3.0.0.4_388.
GoKawiil's interpretation of the reporting above, not reported fact.
Because routers sit at the edge of home and small-business networks, a root-level compromise could let an attacker intercept or redirect traffic from every connected device, not just the router itself. Asus's own warning that 'attackers may use social engineering to trick administrators' suggests the company sees social engineering, not just technical exploitation, as a realistic attack path, which could make the patch alone insufficient without user vigilance.
- Two critical Asus router vulnerabilities (CVSS 9.4 and 8.9) have been patched via firmware updates.
- The VPN config flaw only affects routers set up as VPN clients with imported configuration files, not VPN apps on phones or laptops.
- Asus recommends strong admin passwords and avoiding untrusted scripts or VPN files as added precautions.
Asus RT-AX3000 WiFi 6 Router — If you're replacing or upgrading a vulnerable Asus router, the RT-AX3000 offers modern WiFi 6 performance with regular firmware security updates from Asus. It supports VPN client functionality, so you can still connect to your preferred VPN provider while staying current on patches. A good practice is to always update firmware promptly and only import configuration files from trusted sources.
See Asus RT-AX3000 WiFi 6 Router on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: tomshardware.com — Shane Downing, 2026-10-03
Published there as: “Malicious VPN config files can let attackers run commands on Asus routers”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.