Sunday, June 25th 2023
ASUS Issues Router Product Security Advisory
If you own one of several recent ASUS router models, then you're being urged by ASUS to upgrade your firmware to the latest release as soon as possible, due to a few serious security flaws. The two most severe being CVE-2022-26376 and CVE-2018-1160, both of which are rated 9.8 on a scale of 10 in terms of severity. However, if you're running the third party Asuswrt-Merlin firmware, you're apparently safe, as the author of the third party firmware has already patched all the known security issues that ASUS has announced patches for.
The affected models are the GT6, GT-AXE16000, GT-AX11000 PRO, GT-AX6000, GT-AX11000, GS-AX5400, GS-AX3000, XT9, XT8, XT8 V2, RT-AX86U PRO, RT-AX86U, RT-AX86S, RT-AX82U, RT-AX58U, RT-AX3000, TUF-AX6000, and TUF-AX5400. That's 18 different models in total, all of which should be built around Broadcom hardware. It's unclear if more models are affected or not, but these are the ones ASUS has issued updates for. The security flaws in question could allow someone to take over an unpatched router and make it a part of a botnet or similar. ASUS has suggested turning off features like DDNS and VPN servers, as well as more obvious things like WAN access, port forwarding, port triggers and DMZ until the firmware has been updated on the affected models.
Sources:
ASUS Product Security Advisory, via Bleepingcomputer
The affected models are the GT6, GT-AXE16000, GT-AX11000 PRO, GT-AX6000, GT-AX11000, GS-AX5400, GS-AX3000, XT9, XT8, XT8 V2, RT-AX86U PRO, RT-AX86U, RT-AX86S, RT-AX82U, RT-AX58U, RT-AX3000, TUF-AX6000, and TUF-AX5400. That's 18 different models in total, all of which should be built around Broadcom hardware. It's unclear if more models are affected or not, but these are the ones ASUS has issued updates for. The security flaws in question could allow someone to take over an unpatched router and make it a part of a botnet or similar. ASUS has suggested turning off features like DDNS and VPN servers, as well as more obvious things like WAN access, port forwarding, port triggers and DMZ until the firmware has been updated on the affected models.
30 Comments on ASUS Issues Router Product Security Advisory
third party does asus own work, i used to havea asus router and merlin firmware was pretty good, its similar to stock but has alot of good fixes and other updates
Think of him similar to a guy that would've preemptively made a home-brew bios to optimize chipset voltage/LLC to optimally/efficiently make use of their high-end motherboard hardware, rather than just cranking it up to 'win' and potentially blowing it up. Asus is a sledgehammer and this guy is a scalpel. More aptly, Asus makes a sports car pushed to it's stock limit with a bloated feature-set of software. Merlin is the nimble tuner/optimizer/plug-in version update guy which will make that car better/more reliable, but also will also back-port the software performance/optimization/features to your older soccer-mom car with the same or similarly-applicable engine. Or something like that. I don't know: I'm a nerd, not a car guy. You get what I mean, hopefully. Good hardware needs not just good, but well-managed software. Asus is robust in every way, but inefficient. He makes the best better, and doesn't make the mistakes/choices (for market/planned-obsolescence/support cost reasons) the actual OEM does.
I don't know how closely you or anyone else follows it, but I seem to recall him doing all kinds of work to manage plug-in/feature updates within the main memory and nvram/eeprom, and has even expounded upon potential problems/inefficiencies he's fixed in the past (some of which did not become a big public deal for 'stock' users). My understanding is where-as most stock/open firmware keeps old configurations/settings (it's essentially additive), he routinely goes through the whole damn thing to keep everything tidy; add features (to old/other hardware) where possible and up-to-date (beyond what Asus does/can do in a timely manner) while avoiding potential buffer overflow problems at all cost.
I didn't realize how much of an issue these things potentially could be until I heard of others using stock/other firmware having reliability issues they didn't understand; it turns out running out of nvram post-updates. There was also Asus own recent very-public back-end blunder wrt how their routers handle security re: memory management that took down damn near everything. It proved not only what he was doing is 'optimal', but correct, and needed, optimization, for everything to run to best potential/capability/reliability.
The most he asks for is a manual restart or the very-occasional factory reset to keep things smooth, and explains why very well in both forum posts and included read-mes. Very cool/knowledgeable/professional cat. His 3-minute update percentage bar also only takes about 2 minutes of operation in reality (essentially it will be done before you think it should be), which sums it all up pretty well. Guy tapping temple gif.
He also supports routers as long as humanly possible (essentially they have too little memory for him to add/update Asus' bloated features or they cut an applicable driver branch). While you could argue (some of the) work should be done by Asus, and it should, I honestly question if they are similarly capable, and obviously they purposely wouldn't do some things he implements for people.
The value of what he (constantly/consistently) does is kind of immeasurable, and is the exactly correct person for the job doing it the only way it can realistically be done.