ASUS Patches Four Vulnerabilities in Router Firmware and PC Software, Including Root-Access Flaw
ASUS published four security advisories on November 4, 2026, addressing vulnerabilities affecting router firmware (ASUSWRT), the ASUS System Control Interface driver, and Armoury Crate PC software. The most severe issue, CVE-2026-84730, is a stack buffer overflow in the AiCloud feature that lets an adjacent attacker send a crafted device name to execute shell commands as root. A second router flaw, CVE-2026-84729, allows unauthenticated nearby attackers to send malformed packets causing denial of service or memory corruption. On the PC side, CVE-2026-112116 lets a local low-privileged user send crafted IOCTL requests to the System Control Interface driver to read/write physical memory, while CVE-2026-110464 in Armoury Crate allows local file writes with SYSTEM privileges due to a missing access check. ASUS states there is no confirmed exploitation in the wild and no public exploit code exists.
Entenda a falha
A vulnerabilidade
ASUS fixed four flaws on November 4, 2026. The most severe is CVE-2026-84730 (CVSSv4 8.7), a stack buffer overflow in the AiCloud feature of certain ASUS routers. An attacker on the adjacent network can send a crafted device name and run shell commands as root. CVE-2026-84729 is an out-of-bounds write in router network services. An unauthenticated nearby attacker can send malformed packets to cause denial of service or memory corruption. CVE-2026-112116 is in the ASUS System Control Interface driver. A local low-privileged user can send crafted IOCTL requests to read and write physical memory. CVE-2026-110464 is in Armoury Crate. A missing access check lets a local attacker write files with Local System rights, and it can also crash the system. Affected: ASUSWRT 3.0.0.4_386, 3.0.0.4_388 and 3.0.0.6_102; System Control Interface 3.1.66.0 to 3.1.69.0; Armoury Crate v5.4.10 to v6.5.14. ASUS released fixed firmware and software, but the articles do not give the fixed version numbers.
Como funciona
On the router, AiCloud receives a device name sent by a device on the adjacent network. When the name is crafted, it overflows a buffer on the stack, and that corrupts memory enough to let the attacker run shell commands as root. In the network services, malformed packets from a nearby unauthenticated sender trigger an out-of-bounds write, which crashes the service or corrupts memory. On Windows, the System Control Interface driver accepts IOCTL requests from user-mode programs, and crafted requests from a low-privileged user end up reading and writing physical memory. Armoury Crate performs file writes with Local System rights, and it does not check whether the local requester is allowed to ask for them. The articles do not describe the internal steps in more detail.
Por que é vulnerável
CVE-2026-84730 is a classic stack buffer overflow, where the device name is not kept within the size of the buffer that holds it. CVE-2026-84729 is an out-of-bounds write, so network input is handled without proper bounds control. CVE-2026-110464 is a missing access check, so a privileged operation is available to callers who should not have it. For CVE-2026-112116 the articles only say that crafted IOCTL requests give a low-privileged user access to physical memory, without naming the exact missing check. The articles also do not say why these flaws went unnoticed, and they do not detail what the fixes change.
Como foi descoberta
The articles do not say who found these flaws or how. They only report that ASUS published four security advisories on November 4, 2026. ASUS states there is no confirmed exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 23:16.
Detalhes técnicos
- CVE-2026-84730 (highest severity, CVSSv4 8.7): AiCloud stack buffer overflow enabling root command execution via adjacent network access.
- CVE-2026-84729: Out-of-bounds write in router network services, exploitable by unauthenticated nearby attackers for DoS/memory corruption.
- CVE-2026-112116: Kernel memory access via crafted IOCTL requests to the ASUS System Control Interface driver, usable by a local low-privileged user.
- CVE-2026-110464: Missing access check in Armoury Crate allows local attackers to write files with Local System rights, potentially causing a crash.
- Affected versions: ASUSWRT 3.0.0.4_386, 3.0.0.4_388, 3.0.0.6_102; System Control Interface 3.1.66.0–3.1.69.0; Armoury Crate v5.4.10–v6.5.14.
Remediação
ASUS has released firmware and software updates for all affected products. Router owners should update firmware immediately or disable AiCloud if updating is not possible. PC owners should update Armoury Crate and apply driver fixes via MyASUS or Windows Update.
Linha do tempo
-
ASUS Patches Four Vulnerabilities in Router Firmware and PC Software, Including Root-Access Flaw
ler a análise desta fonte ocultar
ASUS published four security advisories on November 4, 2026, addressing vulnerabilities affecting router firmware (ASUSWRT), the ASUS System Control Interface driver, and Armoury Crate PC software. The most severe issue, CVE-2026-84730, is a stack buffer overflow in the AiCloud feature that lets an adjacent attacker send a crafted device name to execute shell commands as root. A second router flaw, CVE-2026-84729, allows unauthenticated nearby attackers to send malformed packets causing denial of service or memory corruption. On the PC side, CVE-2026-112116 lets a local low-privileged user send crafted IOCTL requests to the System Control Interface driver to read/write physical memory, while CVE-2026-110464 in Armoury Crate allows local file writes with SYSTEM privileges due to a missing access check. ASUS states there is no confirmed exploitation in the wild and no public exploit code exists.
Technical Details
- CVE-2026-84730 (highest severity, CVSSv4 8.7): AiCloud stack buffer overflow enabling root command execution via adjacent network access.
- CVE-2026-84729: Out-of-bounds write in router network services, exploitable by unauthenticated nearby attackers for DoS/memory corruption.
- CVE-2026-112116: Kernel memory access via crafted IOCTL requests to the ASUS System Control Interface driver, usable by a local low-privileged user.
- CVE-2026-110464: Missing access check in Armoury Crate allows local attackers to write files with Local System rights, potentially causing a crash.
- Affected versions: ASUSWRT 3.0.0.4_386, 3.0.0.4_388, 3.0.0.6_102; System Control Interface 3.1.66.0–3.1.69.0; Armoury Crate v5.4.10–v6.5.14.
Remediation
ASUS has released firmware and software updates for all affected products. Router owners should update firmware immediately or disable AiCloud if updating is not possible. PC owners should update Armoury Crate and apply driver fixes via MyASUS or Windows Update.