{"id":"CVE-2026-75775","revision":null,"records":[{"revision":"c4b9ec3d94d445dfb9ab3b1b5b9f875f","observedAt":"2026-10-24T04:48:20.602+00:00","statement":{"source":"cve-program","id":"CVE-2026-75775","aliases":[],"title":"Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-def…","description":"Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router Firmware\u00A0' section on the ASUS Security Advisory for more information.","state":0,"publishedAt":"2026-10-23T07:12:11.893+00:00","modifiedAt":"2026-10-24T03:55:18.582+00:00","affected":[{"ecosystem":"Vendor product","name":"Router","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"ASUS\",\n                    \"product\": \"Router\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"3.0.0.6.102 series\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":7.7,"severity":"HIGH"}],"references":["https://www.asus.com/security-advisory"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-75775","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-75775","identifiers":["CVE-2026-75775"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-24T13:07:12.8861655+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-24T13:07:12.8861655+00:00","lastSuccessAt":"2026-10-24T13:07:13.0994584+00:00","error":null,"lastVerifiedAt":"2026-10-24T13:07:13.0994595+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-9b3cad78792c7367da03684feab05819ddebc4d137048bdbbdabdbb4d2879391-24d772d6d275e66ff9b846f5e1dd397cdb05cd344ee3edac1671551b05b4b42b","complete":true,"records":413898,"lastAttemptAt":"2026-10-24T13:17:09.7466599+00:00","lastSuccessAt":"2026-10-24T13:07:12.6126357+00:00","error":null,"lastVerifiedAt":"2026-10-24T13:17:09.7466599+00:00","snapshotPublishedAt":"2026-10-24T12:29:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-24T13:07:12.8861655+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-24T13:07:12.8861655+00:00","lastSuccessAt":"2026-10-24T13:07:13.2725477+00:00","error":null,"lastVerifiedAt":"2026-10-24T13:07:13.2725483+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-24T13:17:10.0113348+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-24T13:17:10.0113348+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":null,"complete":false,"records":0,"lastAttemptAt":"2026-10-24T13:17:17.7933019+00:00","lastSuccessAt":null,"error":null,"lastVerifiedAt":null,"snapshotPublishedAt":null,"importing":true,"stagedRecords":230735,"checkedIdentifiers":null,"expectedIdentifiers":null}]}