Sunday, June 25th 2023
ASUS Issues Router Product Security Advisory
If you own one of several recent ASUS router models, then you're being urged by ASUS to upgrade your firmware to the latest release as soon as possible, due to a few serious security flaws. The two most severe being CVE-2022-26376 and CVE-2018-1160, both of which are rated 9.8 on a scale of 10 in terms of severity. However, if you're running the third party Asuswrt-Merlin firmware, you're apparently safe, as the author of the third party firmware has already patched all the known security issues that ASUS has announced patches for.
The affected models are the GT6, GT-AXE16000, GT-AX11000 PRO, GT-AX6000, GT-AX11000, GS-AX5400, GS-AX3000, XT9, XT8, XT8 V2, RT-AX86U PRO, RT-AX86U, RT-AX86S, RT-AX82U, RT-AX58U, RT-AX3000, TUF-AX6000, and TUF-AX5400. That's 18 different models in total, all of which should be built around Broadcom hardware. It's unclear if more models are affected or not, but these are the ones ASUS has issued updates for. The security flaws in question could allow someone to take over an unpatched router and make it a part of a botnet or similar. ASUS has suggested turning off features like DDNS and VPN servers, as well as more obvious things like WAN access, port forwarding, port triggers and DMZ until the firmware has been updated on the affected models.
Sources:
ASUS Product Security Advisory, via Bleepingcomputer
The affected models are the GT6, GT-AXE16000, GT-AX11000 PRO, GT-AX6000, GT-AX11000, GS-AX5400, GS-AX3000, XT9, XT8, XT8 V2, RT-AX86U PRO, RT-AX86U, RT-AX86S, RT-AX82U, RT-AX58U, RT-AX3000, TUF-AX6000, and TUF-AX5400. That's 18 different models in total, all of which should be built around Broadcom hardware. It's unclear if more models are affected or not, but these are the ones ASUS has issued updates for. The security flaws in question could allow someone to take over an unpatched router and make it a part of a botnet or similar. ASUS has suggested turning off features like DDNS and VPN servers, as well as more obvious things like WAN access, port forwarding, port triggers and DMZ until the firmware has been updated on the affected models.
30 Comments on ASUS Issues Router Product Security Advisory
But if you feel we're tardy, please take it up with the management.
I'm on 3.0.0.4.388.23285 which is the only one on their site as of writing this.
The release should be within the last week or so. I had an update for the RT-AX86U Pro that I got as a replacement for my trust old R7800 that finally died.
Version 3.0.0.4.388_23565 according to the settings.
www.asus.com/ca-en/networking-iot-servers/wifi-routers/asus-gaming-routers/rt-ax86u/helpdesk_bios/?model2Name=RT-AX86U
Version 3.0.0.4.388.23285 70.86 MB 2023/05/15
Security updates:
-Enabled and supported ECDSA certificates for Let's Encrypt.
-Enhanced protection for credentials.
-Enhanced protection for OTA firmware updates.
-Fixed DoS vulnerabilities in firewall configuration pages. Thanks to Jinghe Gao's contribution.
-Fixed DoS vulerabilities in httpd. Thanks to Howard McGreehan.
-Fixed information disclosure vulnerability. Thanks to Junxu (Hillstone Network Security Research Institute) contribution.
-Fixed CVE-2023-28702 and CVE-2023-28703. Thanks to Xingyu Xu(@tmotfl) contribution.
-Fixed null pointer dereference vulnerabilities. Thanks to Chengfeng Ye, Prism Research Group - cse hkust contribution.
-Fixed the cfg server vulnerability. Thanks to Swing and Wang Duo from Chaitin Security Research Lab.
-Fixed the vulnerability in the logmessage function. Thanks to Swing and Wang Duo from Chaitin Security Research Lab C0ss4ck from Bytedance Wuheng Lab, Feixincheng from X1cT34m
Either this issue was patched for my router back on 5/25/23 and ASUS is very late to the party posting about the firmware update on 6/19/23
My router shouldn't be on their list
OR
Someone at ASUS dropped the ball and they haven't provided the most recent firmware for my router.
for hiring/using the most incompetent & clueless software dweebs that your massive payroll budget could afford, and for not checking/testing their work before releasing new firmware, and potentially putting buttloads of people's systems at risk.. :(..:fear:..:eek:
Factory reset?
Forgetting the wifi on all affected device and rejoining?
Does stock firmware also show the same thing?