CVE-2025-59366 - An authentication-bypass vulnerability exists in AiCloud

Back Back to CVE browser

CRITICAL

An authentication-bypass vulnerability exists in AiCloud

Published Nov 25, 2025

9.2

CRITICAL

CVSS 4.0

EPSS 15.76%

Description

An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba functionality, potentially leading to allow execution of specific functions without proper authorization.

Refer to the Security Update for ASUS Router Firmware section on the ASUS Security Advisory for more information.

Affected products

Vendor ASUS Product Router Default
unaffected
- Version
  3.0.0.4_386
  Status
  affected
  Constraints
  -
- Version
  3.0.0.4_388
  Status
  affected
  Constraints
  -
- Version
  3.0.0.6_102
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ASUS

Router

unaffected

Version	Status	Constraints
3.0.0.4_386	affected	-
3.0.0.4_388	affected	-
3.0.0.6_102	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-22

Path Traversal

CWE-78

OS Command Injection

References (1)

https://www.asus.com/content/security-advisory/
vendor-advisory

Link	Providers	Tags
https://www.asus.com/content/security-advisory/		vendor-advisory

Change history (6)

Sep 23, 2026, 11:07 PM UTC CISA ADP
- SSVC technical impact changed from total to partial
- SSVC automatable changed from yes to no
Sep 22, 2026, 07:35 AM UTC CISA ADP
- SSVC technical impact changed from partial to total
- SSVC automatable changed from no to yes
Sep 22, 2026, 07:23 AM UTC CISA ADP
- SSVC technical impact changed from total to partial
- SSVC automatable changed from yes to no