RT-AX86U 3.0.0.4.388_24243 hacked

[Radek8]

FW for RT AX86U - 3.0.0.4.388_24243 dated 2024/05/13
says:
- Fixed the injection vulnerability in AiCloud.
- Fixed the code execution vulnerability in AiCloud. Thanks to the contribution of chumen77.
And even with this FW, the router was hacked.

 

[Ripshod]

FW for RT AX86U - 3.0.0.4.388_24243 dated 2024/05/13
says:
- Fixed the injection vulnerability in AiCloud.
- Fixed the code execution vulnerability in AiCloud. Thanks to the contribution of chumen77.
And even with this FW, the router was hacked.

That May fix is not related to the current issue.
I wonder if asus are even aware there's an issue.

 

[ColinTaylor]

I wonder if asus are even aware there's an issue.

Yes they are.

 

[Tech9]

And even with this FW, the router was hacked.

Seems like additional conditions have to be met because I had one the same model and firmware bait router running for about a week with both AiCloud active and Access from WAN enabled with weak passwords and it didn't catch anything. Had to stop it because of system changes. It perhaps needs user activity, more time and public WAN IP. Mine was running in DMZ, I have a modem only used by my main network.

 

[eibgrad]

The solution here is NOT continually waiting for fixes to these hacks. It's vowing NEVER EVER to allow direct access to services over the WAN except for OpenVPN server. And even then, you could redirect from the WAN to another internal device supporting OpenVPN server on a much more hardened platform.

In my own case, I run OpenVPN server internally, and keep it on a device which itself is managed using a wifi-enabled AC adapter and my smartphone, so it's only running on-demand. Why keep something running 24/7 when you're using it 5% or less of the time?

Another strategy (when practical) is to limit access based on known public source IPs. If you're always accessing it from your workplace, a second home, the same wifi cafe, etc., you can severely limit your exposure, even if the service is compromised.

I understand the convenience these services offer. But opening them to the public at large 24/7 is just asking for trouble. They aren't written w/ security and privacy as a major concern, but simply to add bullet-points in the marketing, regardless of the risk.

If you need such capabilities, you need to put more effort in creating better solutions.