Recent Security Patches — Still Missing

[Tech9]

is it already time to upgrade

If your router is not affected by the malware and still in good working order - just lock down eventual open to Internet services and continue using it as before. OpenVPN server for connecting back to your network is fine. At some point a new firmware will be released for it. No need to replace it.

 

[visortgw]

If your router is not affected by the malware and still in good working order - just lock down eventual open to Internet services and continue using it as before. OpenVPN server for connecting back to your network is fine. At some point a new firmware will be released for it. No need to replace it.

Or, if he is still concerned, @Jeje2 could install the latest Merlin firmware (3004_388.4_4), which has already been patched.

 

[Tech9]

If this router was not hit already - some of the conditions were not met. I had one bait RT-AX86U running wide open in DMZ and perhaps only because it was behind my gateway with private WAN IP it didn't catch anything. Perhaps all the users behind CGNAT or not using the components with the issue are fine. RT-AX86U is still very capable router and replacing it just in case is a waste of money. Same issue may happen with the new one, no guarantees.

 

[bbunge]

I am wondering if the delay with the AX86U/AX86S firmware is related to the same firmware being used on two similar routers? Sure, the firmware file supposedly contains two firmwares but there could be an issue getting the routers to tell the difference? Who knows? (The Shadow knows...)
But the AX86U is still a worthy router. Same for the AX86S.

 

[Jbennett360]

I am wondering if the delay with the AX86U/AX86S firmware is related to the same firmware being used on two similar routers? Sure, the firmware file supposedly contains two firmwares but there could be an issue getting the routers to tell the difference? Who knows? (The Shadow knows...)
But the AX86U is still a worthy router. Same for the AX86S.

Does seem odd. There's obviously a reason for the 'delay' but I guess we'll never know what or why!

 

[ben29]

What about ax-89x? Still missing also

 

[Tech9]

This one is also quite old model from 2019, Qualcomm based hardware, has a history of large firmware release gaps. Being completely different hardware device with different software - perhaps not affected by the current malware issue. No reports of damaged Qualcomm or MediaTek based devices.

 

[RMerlin]

Folks, complaining here about your specific model not getting an update isn't going to change anything. If your particular model hasn't received an update, you should contact Asus support instead. When you have like 50+ different models to develop, push through the QA team, and then release, things take time, and some models will get it before others.

As for the RT-AX86U, you foilks saw that it was the one the most severely impacted by the recent issues. Based on what I know and without going into details, I can say that Asus are probably working on something more complex than just providing a firmware with an updated AiCloud for this particular model. They haven't forgotten it, it's not being ignored either, it simply requires more work.

If you fear you might be vulnerable, then disable AiCloud and any WAN- exposed service outside of IPSEC/Wireguard/OpenVPN servers, and just wait it out.

 

[XIII]

If you fear you might be vulnerable, then disable AiCloud and any WAN- exposed service outside of IPSEC/Wireguard/OpenVPN servers, and just wait it out.

So also disable ASUS DDNS?

 

[visortgw]

So also disable ASUS DDNS?

DDNS is not a WAN-exposed service. It is necessary (unless, of course, you have a fixed IP address from your ISP) in order to use OpenVPN and the like, but you must still use authentication to access the VPN and the router itself.

 

[XIII]

DDNS is not a WAN-exposed service.

How does it inform ASUS servers of updated IP addresses then?

(Or should I make a difference between WAN communication and WAN service?)

 

[visortgw]

How does it inform ASUS servers of updated IP addresses then?

(Or should I make a difference between WAN communication and WAN service?)

Yes, this is WAN communication to log into your DDNS provider to update your WAN IP as it changes. The DDNS provider does not log into your router. Using OpenVPN (or the encrypted tunnel of your choice), there is only one external access point.

 

[bennor]

• RT-AX82U (appeared 20 November 2024)
• RT-AX86U
• RT-AX88U (appeared 20 November 2024)

Has anyone seen updates for these?

Cross off the RT-AX86U. It apparently got the firmware update late yesterday or early today (2024/11/28).

Release - ASUS RT-AX86U Firmware version 3.0.0.4.388_24323 (2024/11/28)

Available via the Asus app only atm

www.snbforums.com