Recent Security Patches — Still Missing

[visortgw]

Asus has been releasing security-related patches for router firmware over the past couple weeks across their product lines, including 3004.386, 3004.388, and 3006.102 builds. Devices that are still missing updates include (there may be others, but these are ones that I am looking for to patch AiMesh nodes on networks that I manage):

• RT-AX82U (appeared 20 November 2024)
• RT-AX86U
• RT-AX88U (appeared 20 November 2024)

Has anyone seen updates for these?

 

[Squall Leonhart]

their latest gpl is obviously available.

 

[John Fitzgerald]

I look everyday twice for the AX86U and it doesn’t appear.
So, no official yet.

 

[TheLostSwede]

Interesting, as the RT-AX68U has gotten the update and it was apparently EOL.

 

[visortgw]

I look everyday twice for the AX86U and it doesn’t appear.
So, no official yet.

Yes, i find it interesting (?) that Asus has updated several EOL models (RT-AC68U, RT-AC86U, RT-AX68U, ...) prior to taking care of these more recent workhorses.

 

[John Fitzgerald]

Interesting, as the RT-AX68U has gotten the update and it was apparently EOL.

Someone at ASUS may have goofed. Web Admin?

 

[bennor]

Interesting, as the RT-AX68U has gotten the update and it was apparently EOL.

And so did other EOL routers like the RT-AC68U.

 

[mario-sz]

AX3000 V2 not received since 2023 AX3000 still getting. How to understand this?

 

[visortgw]

AX3000 V2 not received since 2023 AX3000 still getting. How to understand this?

Use the RT-AX58U image.

 

[jksmurf]

Has anyone seen updates for these?

I am equally puzzled by the lack of an RT-AX86U update given its popularity.

Oddly there is an AsusMerlin alpha FW with a security patch for amongst others, the RT-AX86U, so would I be correct in assuming RMerlin got a GPL for that model?

 

[mario-sz]

Use the RT-AX58U image.

AX3000 V2 - Broadcom processor and 2,5GBe port

 

[John Fitzgerald]

Use the RT-AX58U image.

I think the V2 ax58u is gnuton only and I don't know the status of his builds.

EDIT

Releases · gnuton/asuswrt-merlin.ng

Extends the support of Merlin firmware to more ASUS routers - gnuton/asuswrt-merlin.ng

github.com

 

[visortgw]

I am equally puzzled by the lack of an RT-AX86U update given its popularity.

Oddly there is an AsusMerlin alpha FW with a security patch for amongst others, the RT-AX86U, so would I be correct in assuming RMerlin got a GPL for that model?

Not necessarily. It could have been specific patches for the vulnerabilities.

 

[Ripshod]

If RMerlin can backport the fixes then surely asus could do the same - unless there's something special in the pipeline.
[/dream]

 

[Tech9]

AX3000 V2 - Broadcom processor and 2,5GBe port

You have to be more specific about model numbers. You have TUF-AX3000 V2 and it's different than RT-AX3000 V2.

 

[RMerlin]

so would I be correct in assuming RMerlin got a GPL for that model?

No. I only received a patch that I had to apply on top of the existing source code, and I had to download and extract the AiMesh modules from their released firmware images. The AiMesh modules are not model-specific, just CPU-specific, so I simply reused the modules from the RT-AX68U.

 

[nickie]

My tuf rt-ax5400 is also missing updates (last update was oct2023)....

 

[XIII]

No. I only received a patch that I had to apply on top of the existing source code

They made that specially for you/us/Asuswrt-merlin? Nice!

 

[fruitcornbread]

On top of the routers other mentioned, there's still RT-AX52, RT-AX89X and ZenWiFi XD4, XD4S / XD4 Plus, XP4, XC5, XD6 & ET9 that are missing firmware update as well.

RT-AX57 Go did mention about fixing AiCloud vulnerabilities in the Oct 15 firmware 3.0.0.6.102_55783 release notes, but I wonder if it is addressing the same issue.

 

[jksmurf]

XD6

I have XD6 units and there is an ASUS update for that. Not sure about the others though.
[EDIT] As pointed out below, the referenced FW does not include the patch for the AICloud security issue.