The dns_ping.cgi endpoint of the ASUS router web management interface passes the dns_ping_list parameter to a shell command without sanitisation (CWE-78). A remote attacker authenticated as administrator can execute arbitrary commands on the device.

Note: CVE-2025-15101 was assigned before our discovery and report and is not attributed to the CYD Campus. ASUS PSIRT confirmed that our report concerned the same vulnerability, affecting additional models not covered by the original patch, and was treated as a continuation of the existing CVE without a new CVE assignment.