ASUS has published four security advisories covering a root-level command execution flaw in the AiCloud feature of its routers, CVE-2026-84730, and three other bugs in router firmware and Windows drivers. The company says none has been actively exploited and no public exploit code exists. The source reporting gave no CVSS scores.
CVE-2026-84730 Gives an Adjacent Attacker Root Shell Commands
CVE-2026-84730 is a buffer overflow in the AiCloud feature of ASUS routers. An attacker on an adjacent network can send a crafted device name and run shell commands as root. The affected firmware lines are ASUSWRT 3.0.0.4_386, 3.0.0.4_388 and 3.0.0.6_102.
Root-level shell access on a router lets an attacker control the device that sits between a home or small office and the internet. AiCloud is the feature that provides remote access to files on a router.
CVE-2026-84729 Targets Router Network Services
A second router flaw, CVE-2026-84729, is an out-of-bounds write in network services. An unauthenticated nearby attacker can use it to cause denial of service or memory corruption.
Two ASUS Windows Driver and Software Bugs Allow Local Privilege Abuse
The four advisories split along the router and PC divide. Two cover router firmware: the AiCloud overflow and the network services out-of-bounds write. Two cover Windows software: the System Control Interface driver, in versions 3.1.66.0 to 3.1.69.0, and Armoury Crate, in versions 5.4.10 to 6.5.14. The Armoury Crate range spans many releases of the utility.
The remaining two advisories concern software for Windows PCs, and both need local access.
CVE-2026-112116 in the System Control Interface Driver
CVE-2026-112116 lets a local low-privileged user read and write physical memory through crafted IOCTLs in the System Control Interface driver. Versions 3.1.66.0 to 3.1.69.0 are affected. Physical memory access is a powerful primitive because it can bypass the protections the operating system places between processes.
CVE-2026-110464 Lets Armoury Crate Write Files as Local System
CVE-2026-110464 is a missing access check in Armoury Crate versions 5.4.10 to 6.5.14. A local attacker can use it to write files with Local System rights or to crash the system. Local System is the highest privilege level on a Windows machine.
Fixes Are Out, With AiCloud as the Interim Option
ASUS has released firmware and software fixes. For routers that cannot be updated, ASUS advises disabling AiCloud. Driver fixes arrive through MyASUS or Windows Update.
Millions of Home and Small-Office Devices Fall in Scope
ASUS routers and PCs reach a large consumer and small-business base, and the router flaws sit in firmware that many owners never update by hand. The adjacent-attacker requirement on CVE-2026-84730 limits who can exploit it to someone on the same local network or within wireless range, which narrows the immediate risk compared with an internet-facing bug.
The two Windows flaws share a different constraint. Both require an attacker who already has a foothold on the machine, and their value lies in turning a limited account into SYSTEM-level control or kernel-level memory access. Flaws of this type tend to matter after another compromise, when an attacker wants to deepen access.
ASUS reports no active exploitation, and the batch includes no vulnerability that a remote, unauthenticated attacker on the internet could use against a router. For routers that cannot be updated, disabling AiCloud removes the feature through which CVE-2026-84730 is reached. The advisory for CVE-2026-84729 describes denial of service or memory corruption as the outcomes of that flaw, so its practical severity depends on whether an attacker can turn the corruption into something more controlled.
ASUS delivers the driver fixes through MyASUS or Windows Update, channels that many PC owners already use for routine updates.
