CVE-2026-11851

{
  "id": "CVE-2026-11851",
  "sourceIdentifier": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1",
  "published": "2026-07-15T02:18:04.743",
  "lastModified": "2026-10-24T22:10:00.210",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Special Elements used in an SQL Command (\"SQL Injection\") in the web management interface of certain ASUS router models allows a remote authenticated user to disclose confidential information via a crafted request that bypasses existing input validation\nRefer to the ' \nSecurity Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information."
    },
    {
      "lang": "es",
      "value": "Neutralización Incorrecta de Elementos Especiales utilizados en un Comando SQL (’Inyección SQL’) en la interfaz de gestión web de ciertos modelos de router ASUS permite a un usuario remoto autenticado divulgar información confidencial mediante una solicitud manipulada que omite la validación de entrada existente.\nConsulte la sección ’Actualización de Seguridad para Firmware de Router ASUS’ en el Aviso de Seguridad de ASUS para más información."
    }
  ],
  "affected": [
    {
      "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1",
      "affectedData": [
        {
          "vendor": "ASUS",
          "product": "Router",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "ASUSWRT 3.0.0.4_386 series",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "ASUSWRT 3.0.0.4_388 series",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "ASUSWRT 3.0.0.6_102 series",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-15T12:35:11.999675Z",
          "id": "CVE-2026-11851",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.asus.com/security-advisory/",
      "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"
    }
  ]
}