ASUS Releases Patches to Fix Critical Security Bugs Impacting Multiple Router Models

Taiwanese business ASUS on Monday produced firmware updates to tackle, among the other issues, nine security bugs impacting a huge variety of router styles.

Of the 9 security flaws, two are rated Critical and 6 are rated High in severity. One particular vulnerability is at this time awaiting examination.

The listing of impacted products and solutions are GT6, GT-AXE16000, GT-AX11000 PRO, GT-AXE11000, GT-AX6000, GT-AX11000, GS-AX5400, GS-AX3000, XT9, XT8, XT8 V2, RT-AX86U PRO, RT-AX86U, RT-AX86S, RT-AX82U, RT-AX58U, RT-AX3000, TUF-AX6000, and TUF-AX5400.

Topping the list of fixes are CVE-2018-1160 and CVE-2022-26376, each of which are rated 9.8 out of a optimum of 10 on the CVSS scoring technique.

CVE-2018-1160 considerations a just about five-calendar year-previous out-of-bounds generate bug in Netatalk variations ahead of 3.1.12 that could enable a remote unauthenticated attacker to reach arbitrary code execution.

CVE-2022-26376 has been described as a memory corruption vulnerability in the Asuswrt firmware that could be triggered by means of a specifically-crafted HTTP request.

The 7 other flaws are as follows –

• CVE-2022-35401 (CVSS rating: 8.1) – An authentication bypass vulnerability that could permit an attacker to deliver destructive HTTP requests to get full administrative entry to the system.

• CVE-2022-38105 (CVSS rating: 7.5) – An info disclosure vulnerability that could be exploited to accessibility sensitive facts by sending specially-crafted network packets.

• CVE-2022-38393 (CVSS score: 7.5) – A denial-of-assistance (DoS) vulnerability that could be induced by sending a specially-crafted network packet.

• CVE-2022-46871 (CVSS score: 8.8) – The use of an out-of-day libusrsctp library that could open focused devices to other attacks.

• CVE-2023-28702 (CVSS score: 8.8) – A command injection flaw that could be exploited by a community attacker to execute arbitrary program commands, disrupt program, or terminate company.

• CVE-2023-28703 (CVSS score: 7.2) – A stack-based buffer overflow vulnerability that could be exploited by an attacker with admin privileges to execute arbitrary process commands, disrupt technique, or terminate provider.

• CVE-2023-31195 (CVSS score: N/A) – An adversary-in-the-center (AitM) flaw that could guide to a hijack of a user’s session.

ASUS is recommending that buyers apply the most recent updates as before long as probable to mitigate security threats. As a workaround, it really is advising customers to disable solutions obtainable from the WAN facet to stay clear of likely undesirable intrusions.

“These solutions include remote access from WAN, port forwarding, DDNS, VPN server, DMZ, [and] port induce,” the corporation explained, urging buyers to periodically audit their machines as very well as established up different passwords for the wi-fi network and the router-administration webpage.

Located this posting interesting? Comply with us on Twitter  and LinkedIn to browse more unique content we write-up.

Some components of this post are sourced from:
thehackernews.com