Solved RT-AX86U - Stuck on old firmware (solved!), WiFi not working (solved!)

[Tech9]

Over the last week I have restored more than 4 routers with such problems

Same here. On Monday alone five different people contacted me with this problem.

Did you guys managed to spot what may be eventually causing this condition?

 

[CrashXRu]

We are sure that the reason is one of the proprietary applications in ASUS routers
there are several of them used

There is a large integration of applications
AiCloud+AiDisk+DDNS ASUS

and there are smaller ones
AiProtection


I interviewed owners of damaged devices for a long time, all of them had a public IP address with configured access services to the router, through the application, and some also used access to files on the connected disk to the router

 

[Tech9]

Any suspected relation between recently found AiCloud related malware and this issue?

RT-AX88U maxing out a core and regularly showing 60+ MB/s upload

I had Diversion and Skynet running but have since disabled them, suspecting that may be the culprit. Essentially, I can't see any device connected to my network that is sending large amounts of data, but when I look at the traffic monitor (Analyzer) it shows this: I only have ~30Mbps of...

www.snbforums.com

 

[CrashXRu]

Any suspected relation between recently found AiCloud related malware and this issue?

RT-AX88U maxing out a core and regularly showing 60+ MB/s upload

I had Diversion and Skynet running but have since disabled them, suspecting that may be the culprit. Essentially, I can't see any device connected to my network that is sending large amounts of data, but when I look at the traffic monitor (Analyzer) it shows this: I only have ~30Mbps of...

www.snbforums.com

it's the same thing, the first symptoms of the problem are
*high CPU load
*incoming or outgoing traffic
*the appearance of foreign processes, for example Sofia
* last stage loss of factory configuration

firmware version is not important, what firmware is not important
the problem was also noticed in Asia, on the Koolshare project

 

[shinasoba]

Have we got a guided fix for introvert like myself who do wish to bother others for help? Or at this stage I do need to seek assistance from the experts who have been helping many other vicitms out there

 

[CrashXRu]

as far as I know the forum rules
you can't post any information about ASUS that concerns factory settings, how to work with them, etc.

there is also no information in the public domain on the Internet.

I can say with certainty that many people know how to do this, but as you can see there are no instructions, and there are reasons for that

I was once closely involved in testing ASUS equipment and was bound by a contract.

All I found was just my research.

 

[CrashXRu]

also, restoring and changing settings is a fundamentally different procedure

full recovery uses
formatting partitions, creating labels, restoring the configuration itself, entering the corresponding values from the label on router into it, as well as installing calibration data for frequency distribution. This is important, because if the routers operate at close sub-frequencies, this will cause unnecessary interference.

I have a fairly large database of settings dumps in order to exclude this factor



but first you should contact ASUS technical support to register the problem

 

[cristianmza]

We are sure that the reason is one of the proprietary applications in ASUS routers
there are several of them used

There is a large integration of applications
AiCloud+AiDisk+DDNS ASUS

and there are smaller ones
AiProtection


I interviewed owners of damaged devices for a long time, all of them had a public IP address with configured access services to the router, through the application, and some also used access to files on the connected disk to the router

I just want to thank CrashXRu for bringing my router back. I've been having this issue since Friday night and now everything is working well. Cheers

 

[sutc95]

I also factory reset the RT-AX86U router once I found out the admin password no longer works. As I was afraid the router was being hacked, I factory reset the router and then wifi stop working. Just the wifi lights are always off and the error " The country code is not exist. Please enter Country code" prompts out. Tried to load the configuration file, old firmware, firmware restoration, etc, nothing works. Contacted ASUS technical support, they cannot figure out what went wrong and asked me to send it to them for repair. However, I just went out of warranty and the repair is probably going to cost at least 1/2 of the price of a new router. I am really frustrated and hope ASUS can come up with a fix. Or if any expert here can guide me through a work around solution, it will be greatly appreciated.

 

[CrashXRu]

I also factory reset the RT-AX86U router once I found out the admin password no longer works. As I was afraid the router was being hacked, I factory reset the router and then wifi stop working. Just the wifi lights are always off and the error " The country code is not exist. Please enter Country code" prompts out. Tried to load the configuration file, old firmware, firmware restoration, etc, nothing works. Contacted ASUS technical support, they cannot figure out what went wrong and asked me to send it to them for repair. However, I just went out of warranty and the repair is probably going to cost at least 1/2 of the price of a new router. I am really frustrated and hope ASUS can come up with a fix. Or if any expert here can guide me through a work around solution, it will be greatly appreciated.

as far as I understand, you should be notified of the cost of repairs, if the cost is high, refuse the repair and take the device

if it is in the same condition, starts up but the wifi does not work, write to telegram, I will help



I have already created several tickets, with a full description of the problem, and also referred to my report in 2022, about an error in the logic of working with the factory configuration.

I hope this will help fix both problems : hacking and data processing error

 

[beachbouy]

I support @ColinTaylor, in that you need to contact tech support,

understand that there is no automation of the process yet, because some data needs to be entered manually

who wants to restore the original calibration of the radio module
if you have saved the router settings before the breakdown, this will help a lot



When you write to me in Telegram, please remember that I am from Siberia in Russia, my time zone is +7 GMT and I can answer with a delay

I will try to help everyone who wants to)


I think they should know that the MAC address and other data are incorrect

My AX-56U died last night too. Same issue. I noticed problems when I got home from overseas - I have OpenVPN set up and it worked fine while overseas through August and September. When I got home I updated to RT-AX56U_3004_388.8_2 and then I couldn't access SSH anymore even though the settings in Admin tab remained the same.
After trying to troubleshoot that issue for over a week, I decided to do a factory reset last night before bed...
I did save a backup of the settings first.
I got access to SSH back.
Then I lost WiFi and got the country code issue. I tried installing the previous firmware just in case it was an issue with the latest firmware, but that didn't work. I did another factory reset with to see if that would work. After the factory reset I lost access to the Router GUI via Ethernet. I can't get an ip address from the router and Windows isn't happy with the connection.
So I googled and found the threads here.
The warranty for my router expired last month...

 

[CrashXRu]

You can restore the router, write to telegram

 

[robman]

So last week I had the exact same issue. My router was working fine as far as I knew. I just wanted to log into its GUI to change a client schedule setting... It kept saying "wrong password".
I tried a hard reboot. Same problem.
Since I had a saved config file I decided to hard reset the router. Once reset I loaded my config. Everything seemed ok except no wifi. I thought I had toggled the radio button by accident. I had not.
I contacted Asus support. I sent them my log file, my config file, the picture of back panel with the router info etc... The whole song and dance.
They asked me to do another reset using their app and going into rescue mode to refresh the firmware. It didn't work.
They sent me an RMA form to send the unit in for repair. I am out of warranty and also without wifi so the down time was going to be a pain.
Long story short, @CrashXRu was able to bring my router back to life from across the globe. I don't know how he did it but he did and I am extremely grateful. In mere minutes my AX86U was fully functional again.
I am hoping that Asus will eventually provide a fix that will not require us to send the unit in. I did my part to let them know what was wrong by repeating what @CrashXRu and @ColinTaylor were saying on here.
FYI: I had AiCloud and DDNS activated when this happened. They are no longer activated. I don't want to risk it.

 

[kaktus]

So last week I had the exact same issue. My router was working fine as far as I knew. I just wanted to log into its GUI to change a client schedule setting... It kept saying "wrong password".
I tried a hard reboot. Same problem.
Since I had a saved config file I decided to hard reset the router. Once reset I loaded my config. Everything seemed ok except no wifi. I thought I had toggled the radio button by accident. I had not.
I contacted Asus support. I sent them my log file, my config file, the picture of back panel with the router info etc... The whole song and dance.
They asked me to do another reset using their app and going into rescue mode to refresh the firmware. It didn't work.
They sent me an RMA form to send the unit in for repair. I am out of warranty and also without wifi so the down time was going to be a pain.
Long story short, @CrashXRu was able to bring my router back to life from across the globe. I don't know how he did it but he did and I am extremely grateful. In mere minutes my AX86U was fully functional again.
I am hoping that Asus will eventually provide a fix that will not require us to send the unit in. I did my part to let them know what was wrong by repeating what @CrashXRu and @ColinTaylor were saying on here.
FYI: I had AiCloud and DDNS activated when this happened. They are no longer activated. I don't want to risk it.

Can CrashXRu confirm that this vulnerability only excists when you activate AiCloud or DDNS?
To be on the safe side I switched from the latest Merlin to the latest stock Asus firmware (Nov 4, 2024).

 

[robman]

Can CrashXRu confirm that this vulnerability only excists when you activate AiCloud or DDNS?
To be on the safe side I switched from the latest Merlin to the latest stock Asus firmware (Nov 4, 2024).

I was affected by this issue while on the latest version of the stock firmware with AiProtection turned on. I don't think that Merlin plays any part in this vulnerability. Earlier in this thread they seemed to suppose that the point of entry was either one of the built in apps like AiCloud or DDNS. I will let them confirm either way.
I don't think you should assume being on stock firmware makes you any safer.

 

[kaktus]

I was affected by this issue while on the latest version of the stock firmware with AiProtection turned on. I don't think that Merlin plays any part in this vulnerability. Earlier in this thread they seemed to suppose that the point of entry was either one of the built in apps like AiCloud or DDNS. I will let them confirm either way.
I don't think you should assume being on stock firmware makes you any safer.

I do not agree with you on the point of not being safer with the latest stock firmware. Asus has released new firmwares since the 4th of November in regards of this vulnerability. This vulnerability also affects the Merlin firmwares, since the vulnerability is likely to be part of the (closed source) AiCloud and DDNS parts of the firmware.

 

[Tech9]

since the vulnerability is likely to be part of the (closed source)

It is in closed source components. Asuswrt-Merlin needs a fix from Asus upstream. It may take some time.

 

[robman]

I do not agree with you on the point of not being safer with the latest stock firmware. Asus has released new firmware since the 4th of November in regards of this vulnerability. This vulnerability also affects the Merlin firmwares, since the vulnerability is likely to be part of the (closed source) AiCloud and DDNS parts of the firmware.

I have never used the Merlin firmware so I'm unaware of its weaknesses. My point was simply that I got this error with the stock firmware. I have my router set up to update the firmware automatically. I just assumed I had the latest firmware installed when the error occurred. In hindsight I agree with you. Since the firmware was just released, about a week ago and in point of fact I only noticed I was affected because I tried to log into my GUI a few days ago, It's very possible I've been affected for a while without knowing it.
I hope you are right that this problem is fixed with the latest update. Thanks for the insight. Very appreciated.
Cheers!

 

[Tech9]

I have never used the Merlin firmware so I'm unaware of its weaknesses.

Not a weakness, but the way it works. Asuswrt-Merlin is modified stock Asuswrt. It's not entirely open source firmware and contains proprietary closed source components. Current security issue is in closed source components and Asus has to provide fix first. Only then Asuswrt-Merlin developer can start building fixed Asuswrt-Merlin version. This process doesn't happen overnight. Asus just released fixed Asuswrt for some of the popular models.

 

[robman]

Not a weakness, but the way it works. Asuswrt-Merlin is modified stock Asuswrt. It's not entirely open source firmware and contains proprietary closed source components. Current security issue is in closed source components and Asus has to provide fix first. Only then Asuswrt-Merlin developer can start building fixed Asuswrt-Merlin version. This process doesn't happen overnight. Asus just released fixed Asuswrt for some of the popular models.

Understood. Thanks for clarifying.
I am a bit confused tho. From what I see on their website, Asus has an official firmware update for the AX86U PRO dated last week: (Current Version : 3.0.0.6.102_34336-gc04af06_403-gd851b)

But for the AX86U non pro version it's still at version: (3.0.0.4.388_24243-g3b611ea) dating back to the month of May of this year.

When I try to update my regular AX86U through the GUI, it stays on this older version and says it's the latest version available.

I didn't realize both machines had separate update forks. This may also affect the availability of the Merlin update I guess.

So my router is still on the same firmware from before the wifi radio turning off after reset issue...