17/11/2025
Did You Know?
Your router protects your home network from the internet. Or it's supposed to. Two major vendors just proved it doesn't. 😅
ASUS: CVE-2025-59367 (CVSS 9.3)
TP-Link: CVE-2025-7850 + CVE-2025-7851 (CVSS 9.3 + 8.7)
Both disclosed November 2025. Both critical. Both letting attackers walk right in.
ASUS routers: No password required.
The vulnerability affects ASUS DSL-AC51, DSL-N16, and DSL-AC750 routers. Authentication bypass.
If your router's management interface is exposed to the internet, an attacker can connect remotely without any credentials. No username. No password. Direct admin access.
Many routers have remote management enabled by default. Some ISPs enable it for "support purposes." Either way, if the admin panel is reachable from outside your network, CVE-2025-59367 makes it completely open.
What can attackers do with admin access? Change your WiFi password and lock you out. Redirect your traffic through their servers. Monitor every device on your network. Use your router to attack other people, making it look like the attacks come from you.
TP-Link: They "fixed" it. Then researchers rooted it again.
Last year, CVE-2024-21827 let attackers get root access through leftover debug code in TP-Link routers. TP-Link patched it in 2024.
Except the debug code is still there. They just made it harder to reach.
Forescout researchers found CVE-2025-7850 and CVE-2025-7851. The patch addressed the original bug but left two problems: the debug functionality stayed in the firmware, just hidden behind a private key check. And if attackers can bypass that check, the entire debug system becomes available again.
The researchers did exactly that. They found CVE-2025-7850, a command injection flaw in the WireGuard VPN settings. An authenticated admin can inject operating system commands that execute with root privileges.
But here's where it gets worse: their protocol analysis showed CVE-2025-7850 can be exploited without credentials in certain network configurations. What looked like a local-only bug turned into a remote attack vector.
Using root access from these two bugs, they found 15 more vulnerabilities across other TP-Link device families. All under coordinated disclosure. All expected to be patched Q1 2026.
The pattern? TP-Link patches individual bugs but doesn't fix the underlying code problems. The vulnerabilities keep coming back in different forms.
Botnets already target these routers.
In May 2025, AyySSHush botnet compromised over 9,000 ASUS routers. It installed persistent SSH backdoors that survive reboots.
Quad7 botnet specifically targets TP-Link routers. It chains vulnerabilities to infect devices, then uses thousands of compromised home routers to launch password spray attacks against Microsoft 365 accounts.
The attacks work because they come from residential IP addresses spread across multiple countries. To Microsoft's systems, it looks like normal login attempts. But it's coordinated, using your router as part of the attack infrastructure.
Check if you're affected.
ASUS DSL router owners: If you have DSL-AC51, DSL-N16, or DSL-AC750, update to firmware 1.1.2.3_1010 immediately.
TP-Link router owners: Affected models include ER605v2, and multiple Omada/Festa VPN router families. Check TP-Link's security advisory for your specific model and apply the latest firmware.
ISP-provided routers: Many ISPs rebrand consumer routers. Dutch ISP Ziggo rebranded the TP-Link Archer C7 as "Wifibooster Ziggo C7." Check what hardware you actually have in your own country...
For routers that won't get patches: Use strong, unique passwords for both WiFi and router admin (20+ characters minimum). Disable remote access from WAN. Turn off port forwarding, DDNS, VPN server, DMZ, and FTP unless you specifically need them. Or replace the router with a currently supported model.
