CVE-2025-2492

CVE Enrichment

CVSS: 9.2 CRITICAL
EPSS: 1.13%
EPSS Percentile: 66.31%
CISA KEV: Not listed

Description

An improper authentication control vulnerability exists in AiCloud. This vulnerability can be triggered by a crafted request, potentially leading to unauthorized execution of functions. Refer to the 'ASUS Router AiCloud vulnerability' section on the ASUS Security Advisory for more information.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: 54bf65a7-a193-42d2-b1ba-8e150d3c35e1
Published: 18-Apr-2025 16:15
Last Modified: 17-Jun-2026 16:07
EPSS Date: 2026-10-28
CWE: CWE-288

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:P /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:L /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

References

54bf65a7-a193-42d2-b1ba-8e150d3c35e1

Last enrichment sync: 29-Oct-2026 09:37
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

access, including CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717 in Ruckus routers, as well as CVE-2025-2492 in ASUS AiCloud routers. UAT-7810 Expands ORB Network With LONGLEASH and Related Tools

CVE (3)

Malware (3)

Threat Actors (2)

MITRE ATT&CK (4)

Vendors (2)

Products (2)

Tools (2)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.