ASUS router CVE-2026-88710: CVSS 8.7 root access from the local network
Four firmware flaws were fixed on 10 November across the 386, 388 and 102 router series, and the worst needs no credentials at all

ASUS router CVE-2026-88710: CVSS 8.7 root access from the local network

ASUS published a router firmware bulletin on 10 November covering four flaws across its 3.0.0.4.386, 3.0.0.4.388 and 3.0.0.6.102 firmware series. One of them hands an attacker on the same network root access without any credentials.

What happened

The most serious issue is CVE-2026-88710, rated 8.7 HIGH. An unauthenticated attacker within range chains unauthenticated queries, identifier guessing and credential overwriting into command injection, and the commands run as root. ASUS lists 3.0.0.4.386, 3.0.0.4.388 and 3.0.0.6.102 series firmware as affected.

The other three are narrower. CVE-2026-88707 (7.1 HIGH) is an out-of-bounds write triggered by an oversized HTTP request parameter from a nearby unauthenticated user. CVE-2026-88709 (7.0 HIGH) executes commands through a crafted USB directory name, but needs physical access. CVE-2026-88708 (5.3 MEDIUM) is an off-by-one error that crashes the affected service.

None of the four is listed as exploited in the wild, and ASUS has not published proof-of-concept code.

Who is affected

  • ASUS routers running 3.0.0.4.386, 3.0.0.4.388 or 3.0.0.6.102 series firmware without the 10 November update
  • Small offices, guesthouses and home offices using a consumer ASUS router as the only edge device
  • Retail parks, shared buildings and co-working sites where many tenants sit inside wifi and LAN range of each other
  • Anyone who plugs an untrusted USB device into the router

What to do now

Update the firmware on every ASUS router you manage now, using the router's own administration page or the ASUS support site for that exact model, then confirm the version changed.

  • Check the model and current firmware version before updating, and confirm the build date after the reboot
  • Disable WAN-side administration and UPnP on routers that do not need them
  • Turn off USB file sharing and AiCloud where they are not in active use
  • Change the router administrator password after updating, and re-check it against known default credentials
  • Replace router models that no longer receive firmware updates rather than leaving them in place

What this means for South African businesses

Consumer routers are frequently the only firewall in a South African small business, and they are rarely patched, because nobody owns the task. The local-network requirement does not help much in practice: a neighbouring tenant, a shared reception area or a compromised laptop inside the office all satisfy it.

My read is that the exposure sits with the businesses that never bought a managed firewall in the first place, typically one to twenty staff with a router from a retail store. Those devices carry the same client data and the same banking sessions as an enterprise edge, with none of the monitoring.

Source

Affected series and fixed firmware are listed in the ASUS product security advisory, with the CVSS scores taken from the CVE records.

Also on the blog

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.

NightsBridge breach: guesthouse booking data is now fueling deposit fraud
South African accommodation platforms are leaking booking references that make a fake payment request look genuine