Patch your Asus RT wireless routers now to avoid ugly surprises

Security experts at Nightwatch Cybersecurity have found serious flaws in the Asus RT wireless routers that could allow hackers to take over them.

Security experts at Nightwatch Cybersecurity serious flaws in the Asus RT wireless routers. Dozens of models don’t implement an adequate protection against cross-site request forgery attacks.

The vulnerability, tracked as CVE-2017-5891, affects the Asus RT wireless RT-AC and RT-N models running firmware older than version 3.0.0.4.380.7378.

Poorly configured devices left with default credentials could be easily accessed by an attacker that can take the control of the devices.

According to the experts at Nightwatch Cybersecurity, which discovered the security vulnerability, CSRF on the login page could be exploited by attackers to submit a login request to the router without the user’s knowledge

“The login page for the router doesn’t have any kind of CSRF protection, thus allowing a malicious website to submit a login request to the router without the user’s knowledge. Obviously, this only works if the site either knows the username and password of the router OR the user hasn’t changed the default credentials (“admin / admin”). To exploit, submit the base-64 encoded username and password as “login_authorization” form post, to the “/login.cgi” URL of the browser.” reads the blog post published by Nightwatch Cybersecurity.

Below an example of the form that be exploited by an attacker to trigger the issue:

Once the attacker has accessed the admin interface of the router he can change the settings, and hijack the DNS,  and perform other malicious activity.

Experts at Nightwatch also discovered two JSONP vulnerabilities that can expose sensitive information, including network map and details about the router.

Asus has solved the CSRF vulnerability with the release of a firmware update in March, anyway, it hasn’t addressed one of the vulnerabilities discovered by Nightwatch, the CVE 2017-5892 flaw.

Below the other bugs fixed with this last firmware release:

• CVE-2017-6547, a cross-site scripting bug in the routers’ HTTP daemon.
• CVE-2017-6549, a session hijack vulnerability in the HTTP daemon.
• CVE-2017-6548, a remote code execution buffer overflow in the routers’ networkmapcommand.

Don’t wast time, update your Router.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Asus RT wireless routers, hacking)

[adrotate banner=”13″]