ASUS 7 consumer routers have high-risk security vulnerabilities, involving AX88U, AX58U, AC86U, etc.
Brook.X
ASUS has recently disclosed a critical security vulnerability in seven of their popular consumer routers, including models such as the AX88U, AX58U, and AC86U. These vulnerabilities could allow attackers to bypass authentication measures and remotely access the routers, potentially leading to information theft or the alteration of DNS settings to redirect users to malicious sites.
The most severe of these vulnerabilities is identified as CVE-2024-3080, an authentication bypass that allows attackers to circumvent login protections, scoring a 9.8 out of 10 on the CVSS rating scale. Another significant vulnerability, CVE-2024-3079, involves a stack buffer overflow issue, enabling attackers with administrative privileges to execute arbitrary commands on the affected routers.
The affected consumer router models are:
- ZenWiFi XT8
- ZenWiFi XT8_V2
- RT-AX88U
- RT-AX58U
- RT-AX57
- RT-AC86U
- RT-AC68U
ASUS has reported that these vulnerabilities have been addressed in the latest firmware updates. However, as of the announcement, updated firmware links were not immediately available. Users of the aforementioned router models are advised to log into their router's system management to check for and install any recent firmware updates.
It's important to note that the release date of firmware updates usually precedes the security announcement. Therefore, the date of the security bulletin and the firmware update may not align.
In addition to these two high-risk vulnerabilities, ASUS has rectified several other issues, including vulnerabilities in the ASUS Download Master client software, now updated to version 3.1.0.114.
ASUS strongly recommends users to update their routers to the latest firmware or software version as soon as possible. If immediate updates are not feasible, users should employ strong account passwords and disable any remote access features, including WAN access, port forwarding, DDNS, DMZ, and port triggering, to enhance security.
