ASUSWRT 3.0.0.4.376_1071 - LAN Backdoor Command Execution

[bsiegel]

Just wanted to give everyone a heads-up. A vulnerability in what appears to be all 376 builds of the ASUS GPL firmware was disclosed on 4 Jan 2015 that allows remote command execution as root from the LAN side. Details are here: (Edit: URL redacted - do not post complete exploit code or links to it. -RM)

I verified the vulnerable code is present in both master (EDIT: URLs redacted -RM)

 

[RMerlin]

I already posted a way to secure routers in this thread:

http://forums.smallnetbuilder.com/showthread.php?t=21774

Do not post links that point to exploit code that could be used by anyone to actively exploit a device, especially not while the manufacturer hasn't even had a chance to address the issue yet, or you will expose everyone using vulnerable devices.

Whoever disclosed that issue needs to get a grip on responsible disclosure. At least the CVE guys have this right, where they don't disclose the details until the manufacturer has had a reasonable amount of time to address the issue. In this case, there isn't even a CVE ID assigned yet...

 

[bsiegel]

Ah, sorry I did some searches but must not have hit the right keywords to locate that thread. Maybe consider making it sticky, at least until a build with a fix becomes available?

It may be some time until / if it is assigned a CVE, but for now the vulnerability is at least catalogued in OSVDB (specific details are omitted). Thanks for keeping on top of this Merl.

 

[RMerlin]

Ah, sorry I did some searches but must not have hit the right keywords to locate that thread. Maybe consider making it sticky, at least until a build with a fix becomes available?

It may be some time until / if it is assigned a CVE, but for now the vulnerability is at least catalogued in OSVDB (specific details are omitted). Thanks for keeping on top of this Merl.

No problem. I also know that Asus are aware and have already discussed amongst themselves on how best to resolve this.

Probably a good idea to make it a temporary sticky, at least until an official fix comes along.