Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface.
Use of Externally-Controlled Format String The product uses a function that accepts a format string as an argument, but the format string originates from an external source.