ASUS warns of new critical auth bypass flaw in AiCloud routers

ASUS released firmware updates addressing nine security vulnerabilities—most notably a critical authentication bypass (CVE-2025-59366) affecting routers with AiCloud, which can be exploited by unauthenticated remote attackers by chaining path traversal and OS command injection. The vendor urges immediate firmware updates and recommends mitigations for end-of-life devices (disabling internet-facing services, strong passwords, etc.); the report also links to a prior exploited flaw (CVE-2025-2492) used in the Operation WrtHug campaign that hijacked thousands of routers potentially used as relay nodes.