Critical ASUS DSL Router Flaw (CVE-2025-59367, CVSS 9.3) Allows Unauthenticated Remote Access

ASUS has issued an urgent advisory about a critical authentication bypass affecting several models in its DSL Series Router lineup, tracked as CVE-2025-59367 with a CVSSv4 score of 9.3, which could allow remote threat actors to access affected systems without valid credentials. According to ASUS, an authentication bypass vulnerability may permit remote attackers to gain unauthorized access into the affected system.

The advisory notes that the flaw affects multiple DSL routers and that ASUS has released a firmware update to fully address it for supported models, including DSL-AC51, DSL-N16, and DSL-AC750, with fixed firmware version 1.1.2.3_1010. For older DSL router models reached End-of-Life, ASUS recommends strict security hardening, such as disabling all services accessible from the internet, including remote access from WAN, port forwarding, DDNS, VPN server, DMZ, port triggering, and FTP.

The guidance also urges users to adopt best practices, such as using different, complex passwords for the wireless network and router administration page, and to regularly check for new firmware and security announcements.