---
cve: "CVE-2026-13313"
severity: "HIGH"
cvss: 8.9
epss: "0.7%"
vendor: "ASUS"
kev: false
exploited: false
published: "2026-10-01 02:16:53"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-23T01:30:11+02:00"
---

# CVE-2026-13313

> 8.9 HIGH

## Beschreibung

An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby executing arbitrary commands with root privileges and potentially affecting other devices connected to the router.
Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.

## CNA-Record (Kanon, cvelistV5)

- CNA: **ASUS**
- State: PUBLISHED
- Stand: 2026-10-02 03:55:30
- CNA-CVSS: **8.9** (`CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Hoch | good |
| PR Privilegien | Hoch | good |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-489** — Active Debug Code
  The product is released with debugging code still enabled or active.

## Angriffsmuster (CAPEC)

- [CAPEC-121 — Exploit Non-Production Interfaces](https://capec.mitre.org/data/definitions/121.html) _(Severity: High)_
- [CAPEC-661 — Root/Jailbreak Detection Evasion via Debugging](https://capec.mitre.org/data/definitions/661.html) _(Severity: Very High)_

## Referenzen

- <https://www.asus.com/security-advisory>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-13313/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_