ASUS RT-AX56U - Path Traversal

Vulnerability

A path traversal vulnerability exists in the update_PLC/PORT file functionality of ASUS RT-AX56U firmware version 3.0.0.4.386.45898 [1]. The URL parameter does not properly filter special characters, allowing an attacker to specify arbitrary paths when uploading a PLC or PORT file. This enables file writes outside the intended directory.

Exploitation

An unauthenticated attacker on the local network can exploit this vulnerability by sending a crafted request to the update_PLC/PORT endpoint with a filename containing path traversal sequences (e.g., ../). The attacker uploads a file with the same name as an existing system file, causing it to be overwritten. No authentication or user interaction is required [1].

Impact

Successful exploitation allows overwriting of arbitrary system files, leading to service disruption (denial of service). The attack impacts integrity and availability, but not confidentiality. The CVSS score is 8.1 (High) with vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H [1].

Mitigation

ASUS released firmware version 3.0.0.4.386.45934 to fix this vulnerability [1]. Users should update their RT-AX56U devices to the patched version. No workarounds are documented; upgrading is the recommended mitigation.