RT-AX86U 3.0.0.4.388_24243 hacked

[Radek8]

FW for RT AX86U - 3.0.0.4.388_24243 dated 2024/05/13
says:
- Fixed the injection vulnerability in AiCloud.
- Fixed the code execution vulnerability in AiCloud. Thanks to the contribution of chumen77.
And even with this FW, the router was hacked.

 

[Ripshod]

FW for RT AX86U - 3.0.0.4.388_24243 dated 2024/05/13
says:
- Fixed the injection vulnerability in AiCloud.
- Fixed the code execution vulnerability in AiCloud. Thanks to the contribution of chumen77.
And even with this FW, the router was hacked.

That May fix is not related to the current issue.
I wonder if asus are even aware there's an issue.

 

[ColinTaylor]

I wonder if asus are even aware there's an issue.

Yes they are.

 

[Tech9]

And even with this FW, the router was hacked.

Seems like additional conditions have to be met because I had one the same model and firmware bait router running for about a week with both AiCloud active and Access from WAN enabled with weak passwords and it didn't catch anything. Had to stop it because of system changes. It perhaps needs user activity, more time and public WAN IP. Mine was running in DMZ, I have a modem only used by my main network.

 

[eibgrad]

The solution here is NOT continually waiting for fixes to these hacks. It's vowing NEVER EVER to allow direct access to services over the WAN except for OpenVPN server. And even then, you could redirect from the WAN to another internal device supporting OpenVPN server on a much more hardened platform.

In my own case, I run OpenVPN server internally, and keep it on a device which itself is managed using a wifi-enabled AC adapter and my smartphone, so it's only running on-demand. Why keep something running 24/7 when you're using it 5% or less of the time?

Another strategy (when practical) is to limit access based on known public source IPs. If you're always accessing it from your workplace, a second home, the same wifi cafe, etc., you can severely limit your exposure, even if the service is compromised.

I understand the convenience these services offer. But opening them to the public at large 24/7 is just asking for trouble. They aren't written w/ security and privacy as a major concern, but simply to add bullet-points in the marketing, regardless of the risk.

If you need such capabilities, you need to put more effort in creating better solutions.

 

[Tech9]

If you need such capabilities, you need to put more effort in creating better solutions.

Correct, but not expected from an average user of this type consumer device.

 

[eibgrad]

Correct, but not expected from an average user of this type consumer device.

Fair point. But I have to assume most users active on this platform (and particularly this Merlin forum) are NOT typical, so it behooves them to put more effort into finding an appropriate solution then simply assuming what ASUS makes available is safe.

 

[Tech9]

and particularly this Merlin forum

Yes, people reading SNB Forums have advantage - early warning or eventual workaround. The thread was posted in a wrong forum though. It's about stock Asuswrt not updated for months. There was a round of firmware updates recently for other models, but Asus forgot about still popular RT-AX86U.

 

[jerry6]

FW for RT AX86U - 3.0.0.4.388_24243 dated 2024/05/13
says:
- Fixed the injection vulnerability in AiCloud.
- Fixed the code execution vulnerability in AiCloud. Thanks to the contribution of chumen77.
And even with this FW, the router was hacked.

So not Merlin FW ?

 

[Tech9]

So not Merlin FW ?

The same issue was reported when running both Asuswrt and Asuswrt-Merlin firmware. Suspected AiCloud is Asus close source component.

 

[Mogsy]

That May fix is not related to the current issue.
I wonder if asus are even aware there's an issue.

What current issue? Did I miss news/thread

 

[Ripshod]

This thread has been edited and much was merged with the other thread. These are the dregs of a dead thread now.
Merged with this:

RT-AX88U maxing out a core and regularly showing 60+ MB/s upload

I had Diversion and Skynet running but have since disabled them, suspecting that may be the culprit. Essentially, I can't see any device connected to my network that is sending large amounts of data, but when I look at the traffic monitor (Analyzer) it shows this: I only have ~30Mbps of...

www.snbforums.com

 

[Mogsy]

This thread has been edited and much was merged with the other thread. These are the dregs of a dead thread now.
Merged with this:

RT-AX88U maxing out a core and regularly showing 60+ MB/s upload

I had Diversion and Skynet running but have since disabled them, suspecting that may be the culprit. Essentially, I can't see any device connected to my network that is sending large amounts of data, but when I look at the traffic monitor (Analyzer) it shows this: I only have ~30Mbps of...

www.snbforums.com

Thanks, very interesting read. I’m behind CG-Nat, if not I would have many more features switched on

 

[laracroftonline]

I had this same issue on my gt axe11000 disabled aicloud services and changed the password and now it’s working fine.

 

[jerry6]

The same issue was reported when running both Asuswrt and Asuswrt-Merlin firmware. Suspected AiCloud is Asus close source component.

thanks don't use clouds , i like sunshine . Anything not necessary is turned off on my router