CVE-2026-14911
Quick assessment
Affected
ASUS Router
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ASUS 路由器模块中存在网页生成过程中输入中性化处理不当的问题（即“跨站脚本攻击”，Cross-Site Scripting，XSS），可导致远程攻击者在经过身份验证的用户访问构造的恶意 URL 时，读取 DOM 信息、修改路由器设置，并引发拒绝服务（DoS）状况。有关更多信息，请参阅 ASUS 安全公告中的“ASUS 路由器固件安全更新”部分。
Possible ATT&CK Techniques 1 AI
T1059.007 · JavaScript
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-14911
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the '
Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-14911
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14911
请登录查看更多情报信息。
Same Patch Batch · ASUS · 2026-10-07 · 4 CVEs total
| CVE-2026-19386 | 9.3 CRITICAL | 华硕路由器配置上传栈溢出漏洞 |
| CVE-2026-16528 | 8.4 HIGH | ASUS路由器日志注入漏洞，泄露DDNS凭据 |
| CVE-2026-19396 | 7.7 HIGH | ASUS RT-BE57路由器PRNG种子可预测漏洞 |
IV. Related Vulnerabilities
Same weakness: CWE-79
-
CVE-2026-104393
WordPress Happy Addons for Elementor plugin <= 3.50.0 - Cros -
CVE-2026-105875
WordPress Prime Slider – Addons For Elementor plugin <= 4.6. -
CVE-2026-104391
WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Si -
CVE-2026-105884
WordPress Rocket Lazy Load plugin <= 2.4.0 - Cross Site Scri -
CVE-2026-105873
WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cr
V. Comments for CVE-2026-14911
No comments yet