ASUS RT-AX56U Router - Stack-based buffer overflow

Vulnerability

The ASUS RT-AX56U Wi-Fi Router running firmware version 3.0.0.4.386.44266 contains a stack-based buffer overflow vulnerability in the httpd service due to improper validation of parameter lengths [1]. An attacker must be authenticated on the local network and send a specially crafted HTTP request to trigger the overflow.

Exploitation

An attacker with network access to the LAN and valid low-privilege credentials can exploit this vulnerability by sending a crafted HTTP request with an overly long parameter to the router's httpd service [1]. No user interaction is required, and the attack can be executed remotely from within the local network.

Impact

Successful exploitation allows the attacker to execute arbitrary code with root privileges, leading to full compromise of the router, including information disclosure, control over the device, or disruption of service [1].

Mitigation

ASUS released firmware version 3.0.0.4.386.45898 to address this vulnerability [1]. Users should update their RT-AX56U routers immediately. No workarounds are documented.