Release Asuswrt-Merlin 386.12_6 is now available for AC models

[unclebuk]

I don't know. You may have malware running already, I don't know.

How can I check, confirm existence of malware? Any advice? What would be the most obvious and usual symptoms, other than I am using old f/w?

 

[Tech9]

I have never used AiProtection. Does it work...

How can I check, confirm existence of malware?

Both conversations are unrelated to this firmware release thread. There was a malware infecting 384 firmware and it was never discovered how it gets in. It was discussed >3 years ago. AiProtection is discussed on a regular basis. What firmware you are going to run is entirely your choice. If you don't want to upgrade - don't upgrade.

 

[unclebuk]

Both conversations are unrelated to this firmware release thread. There was a malware infecting 384 firmware and it was never discovered how it gets in. It was discussed >3 years ago. AiProtection is discussed on a regular basis. What firmware you are going to run is entirely your choice. If you don't want to upgrade - don't upgrade.

Oh, sounds like a big fat nothing-burger....LOL. I see the last merlin f/w security update was in 386.10 in March 2023 and prior to that was 386.5_2 in March 2022. 12 months separating any security updates, and not terribly impactful security issues. But please indicate otherwise as you see fit.
My intent is to upgrade, but to a stable release and one that does not break followed by another release that breaks something else and so on. So, w/o proof of these unknown security breaches, and some bonafide issues besiging asus 86U's with older firmware you're under water with the security arguement devoid of any substance. But thanks for chiming in.
Fragattack is also mentioned in one f/w release (386.2_6 (6-June-2021) which is totally defeated and rendered benign by HTTPS.

 

[Tech9]

But thanks for chiming in.

As I said - on your router and your network you are free to do whatever you find is best. You can even disable the firewall if you want to. This doesn't affect me in any way. You asked for an opinion - you got my opinion. You're very welcome. For other unrelated to this firmware release questions - open separate threads and we may discuss.

 

[unclebuk]

As I said - on your router and your network you are free to do whatever you find is best. You can even disable the firewall if you want to. This doesn't affect me in any way. You asked for an opinion - you got my opinion. You're very welcome. For other unrelated to this firmware release questions - open separate threads and we may discuss.

The better response would be to address a recently discovered vulnerability in Sept 2023 affecting 3 Asus routers including AC86U described as CVE-2023-39238, CVE-2023-39239, and CVE-2023-39240 with a very high potential for remote code execution and if in fact this know security breach and applicable patch has been added to recent merlin f/w updates? The dates of this [ASUS released patches that address the three flaws in early August 2023 for RT-AX55, in May 2023 for AX56U_V2, and in July 2023 for RT-AC86U] and the merlin changelog for 386.xx may infer this may not be the case and thus Merlin f/w for AC86U are susceptible to this securtiy flaw.

Link to Asus router security report

Description of vulnerabilities

 

[Tech9]

The better response would be to address a recently discovered vulnerability

Sorry, I don't address any Asus vulnerabilities. You have to ask someone else for that. I don't even have any Asus routers on my networks.

Is that your best advice?

No, you rejected my best advice already. I have no more suggestions to you.

 

[bennor]

I have two Asus routers, an AC88U (very good, stable) currently in storage and my current "ride" a 2017 model year AC86U on merlin 384.19 (refer to attached scr-shot) chugging along in a hot, under-ventilated non air conditioned room in hot and humid SE Asia and performance and reliability has been stellar.

The plastc housing has virtually disintegrated likely due to thermal stress's. I am pondering f/w upgrade to 386.10 despite very stable operation with current 384.19 with moderate use from 2 or 3 iPads, iPhones, a few laptops, TV's, android devices galore, guest network initiated along with OpenVPN Client and OpenVPN server operational. All is good, so I ask why I need to update the Merlin f/w?

After reading the reports of faulty and failing 86U's I question if I should leave well enough alone and motor on under current configurations.

Note that this topic is discussing the 386.12_6 firmware and issues with it. It appears you are asking about updating from a almost four year old firmware (384.19) to a firmware version released last year (386.10). Since your question doesn't appear to be specifically about 386.12_6, perhaps you should start a separate thread discussion since your question isn't really relevant to this firmware being discussed. Or review, if you haven't done so already, the 386.10 firmware discussion thread to see if there are any issues with the 386.10 firmware:

Release - Asuswrt-Merlin 386.10 is now available for AC models

386.10 is now available for WIfi 5 (AC) models. - NEW: Added Site Survey page under Network Tools tab. (RT-AC86U/GT-AC2900). - UPDATED: dnsmasq to 2.89. - UPDATED: openvpn to 2.6.0. - UPDATED: openssl to 1.1.1t. - UPDATED: miniupnpd to 2.3.3. - UPDATED: Asus security daemon updated to...

www.snbforums.com

To the general question of "should I update to the latest firmware version", 386.12_6 in this case. Many will recommend keeping a router updated to the latest firmware for security vulnerability patches. There have been a number of CVE's and module patches between 14-Aug-2020 and today. One can review those updates by seeing the Asus-Merlin Change Log for that branch and decide for one's self, based on their own use case, if its worth updating or not:

Changelog (386.xx) | Asuswrt-Merlin

www.asuswrt-merlin.net

Note: It appears at least 12 CVE's have apparently been patched between 384.19 and 386.12_6.

If it were me, I'd update that three plus year old firmware to the latest stable firmware and test the router to ensure all features configured for my use case worked. If it doesn't work for my use case then I'd roll back the next previous firmware version and test again. But that's what I'd do in my use case. What you do is up to you and your use case. You may be happy with the old router firmware (and its possible unpatched security vulnerabilities).

 

[thiggins]

@unclebuk Stop trolling or you will get a timeout.
@L&LD @Tech9 Just. Stop. Replying. You both should know better

 

[RMerlin]

This thread has gone completely off the rails. This thread has served its original use, so I'm locking it.