CVE-2025-59367 is a critical (CVSS 9.8) authentication bypass in certain ASUS DSL series routers, including DSL-AC51, DSL-AC750 and DSL-N16. Update the firmware as described in the ASUS Security Advisory under Security Update for DSL Series Router. The sections below cover who is affected, how to check, and what to do now.
What's affected
The record lists the ASUS DSL-AC51, DSL-AC750 and DSL-N16 routers and their firmware. It says certain DSL series routers are affected and refers to the Security Update for DSL Series Router section of the ASUS Security Advisory.
The record does not give firmware version numbers, and I could not confirm them from the vendor page, so read that section for the fixed firmware for your exact model and hardware revision.
How to check if you're exposed
Log in to the router's admin page and note the model and current firmware version, then compare with the version in the ASUS advisory for your model.
Also check whether the admin interface or any remote management feature is reachable from the internet. From a machine outside your network, a scan of the router's public address for open web admin ports will show it. If remote administration is on and you do not need it, turn it off.
What to do now
- Identify any DSL-AC51, DSL-AC750 or DSL-N16 devices in offices, branches and homes of remote staff.
- Open the ASUS Security Advisory and apply the firmware listed for each model.
- Disable remote administration from the WAN side unless you truly need it.
- Change the admin password after updating, and review any port forwarding rules for entries you do not recognise.
- Replace devices that no longer receive firmware updates.
Why it matters
The record maps this to CWE-288 (authentication bypass using an alternate path or channel) and CWE-306 (missing authentication for a critical function). The description is brief: remote attackers may gain unauthorized access into the affected system.
A bypass on a router matters because the router sits in front of everything behind it. Control of the device lets someone change DNS settings, watch traffic or reach the internal network. The vector shows network access with no privileges or user interaction, and high impact on all three properties. It is not on the CISA KEV list, and the record has no exploitation information.
Missing authentication is the simplest class of access flaw to describe and one of the easiest to prevent. A function that changes data or reveals data must check who is asking, every time, on the server. Hiding the URL, or relying on the front end to show a login screen first, does not count as a check.
A useful habit is to list every route, endpoint and file an application exposes and mark which ones enforce a login. Anything unmarked is a finding until proven otherwise. Network controls such as an allow list or a VPN reduce who can reach the service, but they are a layer on top of authentication, not a substitute for it.
A dependency scan will not see this one, because it concerns a product or service rather than a package in your code. The practical step is an asset inventory that records which of these products you run, which version, and who owns it. You can look up the record for this CVE in the Safeguard Gold directory and use the free scan at gold.safeguard.sh/scan for the software you build yourself.
Quick check
Which routers does CVE-2025-59367 affect?
The record lists DSL-AC51, DSL-AC750 and DSL-N16 and their firmware. Check ASUS for the fixed firmware version.
What is the best mitigation besides updating?
Turn off remote administration from the internet side and keep the admin page reachable only from inside.
Sources
- ASUS Security Advisory (listed in the record)
- NVD record data
Last reviewed: 18 October 2026.
