Reply To: many Asus routers compromised Here more infos about this serious backdoor, which can only be removed with newest (patched) firmware and factory-reset, as it is written into NVRAM. https://www.greynoise.io/blog/stealthy-backdoor-campaign-affecting-asus-routers This topic was modified 11…

[UK Sentinel]

I have been making sure my DSL-AX82U has not been compromised over the last 6 weeks or so when I first was made aware, I have been checking weekly on the Remote SSH option in ASUSWRT UI, in particular if SSH access on port 53282 has been configured.

ASUS has released a firmware updates a while ago (not sure which models) to patch CVE-2023-39780 the command injection vulnerability exploited in this backdoor campaign.

I know these ASUS routers are impacted, but unsure which others maybe also vulnerable.

• RT-AC3100
• RT-AC3200
• RT-AX55

 

I am going to have a chat at ASUS as they keep removing older firmware versions and the associated changelog, so you cannot check which firmware’s have had what CVE’s applied/resolved.

I.e. RT-AX55 for example, released back in 2020, but oldest firmware available for reference and download is 2024/11/11 – 3.0.0.4.386_52332

 

FWIW: there is the https://nvd.nist.gov/ but for the averidge ASUS owner, well beyond their area of knowledge.

 

In a completely sane world, madness is the only freedom (J.G.Ballard).

Liked by:

You need to login in order to vote