External risk intelligence

AiCloud Authentication Bypass Via Samba Functionality.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2025-59366

The vulnerability affects AiCloud, a feature on ASUS routers designed to provide remote access to network resources and storage. This functionality is intended to be accessed over a network, and such router features are commonly exposed to the internet to facilitate remote file access and management, making them a typical edge-facing service in many deployments.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An authentication-bypass vulnerability in AiCloud, a feature on ASUS routers, could allow unauthorized access to specific functions due to an unintended interaction with Samba functionality. This affects network-attached storage and remote access capabilities.

Unauthorized function execution is possible.
Protects remote access and network storage.
Confirm AiCloud relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could potentially reach this vulnerability by exploiting a flaw in the Samba functionality within AiCloud. This exposure might allow an attacker to bypass authentication and execute specific functions without proper authorization, leading to unauthorized access and control.

Accessible over the network.
Triggers via Samba functionality.
Unauthorized function execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in AiCloud could allow unauthorized access to specific functions by bypassing authentication, potentially through unintended interactions with Samba functionality when supported by the advisory.

Unauthorized function execution.
May occur via network access.
Compromised service behavior.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in AiCloud, triggered by Samba functionality, requires a coordinated response from infrastructure, platform, and security teams. The first step is to identify all instances of the affected ASUS router firmware, determine their network exposure and business criticality, and confirm the accountable owner before planning remediation.

Infrastructure/Platform teams own the issue.
Verify AiCloud exposure and criticality first.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AiCloud in the context of CVE-2025-59366?

AiCloud is a feature suite found in ASUS router firmware. It is primarily designed to facilitate remote access to network-attached storage and shared files, effectively turning your router into a personal cloud gateway. It manages how users connect to their home or office data from outside the local network.

What does authentication bypass mean for this vulnerability?

An authentication bypass means an attacker can interact with specific functions of the AiCloud service without providing the required login credentials. In this case, the weakness stems from how the software handles Samba—a protocol used for file sharing. This allows unauthorized actions that should be gated behind a secure password prompt.

How is this vulnerability triggered?

This flaw is triggered by an unintended side effect within the Samba-related components of AiCloud. The vulnerability does not arise from standard administrative login attempts, but rather through specific interactions with the file-sharing architecture. If the Samba service is disabled or not in use, the specific conditions required to trigger this bypass may not be met.

Why should I care about CVE-2025-59366 if I own an ASUS router?

According to Halo Surface Signal, this vulnerability is significant because AiCloud is often intentionally configured to be internet-facing to allow remote file access. Because the service is designed to communicate across networks, the potential for unauthorized access is higher for devices that are reachable directly from the public internet.

How should I respond to this threat?

The first step is to audit your environment to identify any ASUS routers running firmware that includes the affected AiCloud feature. Determine if these devices are exposed to the internet and assess their role in your network. Once identified, prioritize coordinating with your security or infrastructure team to track updates from the vendor.

References

www.asus.com/content/security-advisory/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.