ASUS discovers critical flaw in AiCloud routers

ASUS has revealed a critical security flaw impacting routers with AiCloud enabled that could permit remote attackers to perform unauthorized execution of functions on susceptible devices. The vulnerability has been tracked as CVE-2025-2492, and has a CVSS score of 9.2 out of a maximum of 10.0.

"An improper authentication control vulnerability exists in certain ASUS router firmware series," ASUS said in an advisory. "This vulnerability can be triggered by a crafted request, potentially leading to unauthorized execution of functions."

The shortcoming has been addressed with firmware updates for the following branches -

·         3.0.0.4_382

·         3.0.0.4_386

·         3.0.0.4_388, and

·         3.0.0.6_102

For optimal protection, it's recommended to update their instances to the latest version of the firmware.

ASUS has asked to use different passwords for wireless network and router administration page.

"Use passwords that have at least 10 characters, with a mix of capital letters, numbers, and symbols,” it said. "Do not use the same password for more than one device or service. Do not use passwords with consecutive numbers or letters, such as 1234567890, abcdefghij, or qwertyuiop."

If immediate patching is not an option or the routers have reached end-of-life (EoL), it's advised to make sure that login and Wi-Fi passwords are strong.

Another option is to disable AiCloud and any service that can be accessed from the internet, such as remote access from WAN, port forwarding, DDNS, VPN server, DMZ, port triggering, and FTP.