ASUS fixes router and PC software flaws in security updates

ASUS has issued four security advisories on 4 November 2026 addressing vulnerabilities in router firmware and ASUS PC software, including Armoury Crate. The affected products span ASUSWRT router firmware versions 3.0.0.4_386, 3.0.0.4_388 and 3.0.0.6_102, System Control Interface versions 3.1.66.0 to 3.1.69.0, and Armoury Crate versions 5.4.10 to 6.5.14. Researchers report four CVEs: CVE-2026-84730, CVE-2026-84729, CVE-2026-112116 and CVE-2026-110464, with CVSSv4 scores up to 8.7. ASUS notes that, to date, there has been no confirmed exploitation in the wild.

The disclosure details differing attack surfaces across router and PC software. CVE-2026-84730 is a buffer overflow in the AiCloud feature of certain ASUS routers, enabling a nearby attacker to craft a device name and execute shell commands as root. CVE-2026-84729 describes an out-of-bounds write in router network services allowing unauthenticated near-by packet input to cause denial or memory corruption.

CVE-2026-112116 affects the System Control Interface driver, potentially permitting a local low-privilege user to read and write physical memory via crafted IOCTL requests. CVE-2026-110464 in Armoury Crate allows a local attacker to write files with Local System rights due to missing access checks and can crash the system.

ASUS confirms fixes have been released and advises owners to update firmware or Armoury Crate via MyASUS or Windows Update; router users should apply the latest firmware, or disable AiCloud if updates are not possible. The company emphasises there is no evidence of active exploitation as of the advisories.