Patchfirst: ASUS vulnerabilitieshttps://patchfirst.co/vendor/asus/New and newly exploited ASUS CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMTCVE-2026-14911: Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a…https://patchfirst.co/cve/CVE-2026-14911/CVE-2026-14911Wed, 07 Oct 2026 00:00:00 GMTASUS · Router. Not in CISA KEV. EPSS 0.3% (higher than 24.9% of CVEs). CVSS 9.3 CRITICAL. Priority 13.7 of 100.CVE-2026-19386: A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code…https://patchfirst.co/cve/CVE-2026-19386/CVE-2026-19386Wed, 07 Oct 2026 00:00:00 GMTASUS · Router. Not in CISA KEV. EPSS 0.2% (higher than 8.9% of CVEs). CVSS 9.3 CRITICAL. Priority 10.5 of 100.CVE-2026-14157: Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute…https://patchfirst.co/cve/CVE-2026-14157/CVE-2026-14157Thu, 01 Oct 2026 00:00:00 GMTASUS · Router. Not in CISA KEV. EPSS 0.8% (higher than 55.3% of CVEs). CVSS 9.4 CRITICAL. Priority 19.0 of 100.[KEV] CVE-2025-59374: ASUS Live Update Embedded Malicious Code Vulnerabilityhttps://patchfirst.co/cve/CVE-2025-59374/CVE-2025-59374#kevWed, 17 Dec 2025 00:00:00 GMTASUS · Live Update. In CISA KEV since 2025-12-17. ENISA EUVD lists it as exploited. EPSS 1.2% (higher than 68.1% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1195.002 Compromise Software Supply Chain; T1059 Command and Scripting Interpreter. Priority 63.5 of 100.kevT1195.002T1059[KEV] CVE-2021-32030: ASUS Routers Improper Authentication Vulnerabilityhttps://patchfirst.co/cve/CVE-2021-32030/CVE-2021-32030#kevMon, 02 Jun 2025 00:00:00 GMTASUS · Routers. In CISA KEV since 2025-06-02. ENISA EUVD lists it as exploited. EPSS 99.4% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1040 Network Sniffing; T1098 Account Manipulation. Priority 69.8 of 100.kevpublic-exploitT1068T1040T1098[KEV] CVE-2023-39780: ASUS RT-AX55 Routers OS Command Injection Vulnerabilityhttps://patchfirst.co/cve/CVE-2023-39780/CVE-2023-39780#kevMon, 02 Jun 2025 00:00:00 GMTASUS · RT-AX55 Routers. In CISA KEV since 2025-06-02. ENISA EUVD lists it as exploited. EPSS 39.5% (higher than 98.6% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1133 External Remote Services; T1588 Obtain Capabilities; T1059.004 Unix Shell; T1021.004 SSH. Priority 68.9 of 100.kevpublic-exploitT1078T1133T1588T1059.004T1021.004CVE-2025-2492: An improper authentication control vulnerability exists in AiCloudhttps://patchfirst.co/cve/CVE-2025-2492/CVE-2025-2492Fri, 18 Apr 2025 00:00:00 GMTASUS · Router. Not in CISA KEV. EPSS 1.1% (higher than 66.4% of CVEs). CVSS 9.2 CRITICAL. Public exploit code exists. Priority 66.9 of 100.public-exploitCVE-2024-12912: An improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command executionhttps://patchfirst.co/cve/CVE-2024-12912/CVE-2024-12912Thu, 02 Jan 2025 00:00:00 GMTASUS · Router. Not in CISA KEV. EPSS 1.2% (higher than 69.1% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. Priority 65.5 of 100.public-exploitCVE-2024-3080: ASUS Router - Improper Authenticationhttps://patchfirst.co/cve/CVE-2024-3080/CVE-2024-3080Fri, 14 Jun 2024 00:00:00 GMTASUS · ZenWiFi XT8. Not in CISA KEV. EPSS 43.5% (higher than 98.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 67.7 of 100.public-exploitCVE-2023-41348: ASUS RT-AX55 - command injection - 4https://patchfirst.co/cve/CVE-2023-41348/CVE-2023-41348Fri, 03 Nov 2023 00:00:00 GMTASUS · RT-AX55. Not in CISA KEV. EPSS 1.3% (higher than 70.2% of CVEs). CVSS 8.8 HIGH. Priority 61.8 of 100.CVE-2023-41347: ASUS RT-AX55 - command injection - 3https://patchfirst.co/cve/CVE-2023-41347/CVE-2023-41347Fri, 03 Nov 2023 00:00:00 GMTASUS · RT-AX55. Not in CISA KEV. EPSS 1.3% (higher than 70.2% of CVEs). CVSS 8.8 HIGH. Priority 61.8 of 100.CVE-2023-41345: ASUS RT-AX55 - command injection - 1https://patchfirst.co/cve/CVE-2023-41345/CVE-2023-41345Fri, 03 Nov 2023 00:00:00 GMTASUS · RT-AX55. Not in CISA KEV. EPSS 1.3% (higher than 70.2% of CVEs). CVSS 8.8 HIGH. Priority 61.8 of 100.CVE-2023-41346: ASUS RT-AX55 - command injection - 2https://patchfirst.co/cve/CVE-2023-41346/CVE-2023-41346Fri, 03 Nov 2023 00:00:00 GMTASUS · RT-AX55. Not in CISA KEV. EPSS 1.2% (higher than 68.2% of CVEs). CVSS 8.8 HIGH. Priority 61.4 of 100.CVE-2021-28199: ASUS BMC's firmware: buffer overflow - Modify user’s information functionhttps://patchfirst.co/cve/CVE-2021-28199/CVE-2021-28199Tue, 06 Apr 2021 00:00:00 GMTASUS · BMC firmware for ASMB9-iKVM. Not in CISA KEV. EPSS 1.9% (higher than 79.4% of CVEs). CVSS 4.9 MEDIUM. Priority 59.3 of 100.