ASUS RT-AX56U - SQL Injection

Vulnerability

The ASUS RT-AX56U router's SQL handling function contains an SQL injection vulnerability due to insufficient validation of user input [1]. This affects firmware version 3.0.0.4.386.45898. The vulnerability is present in the storage of SQL data parameters, allowing injection of arbitrary SQL syntax without requiring authentication [1].

Exploitation

An unauthenticated attacker on the local area network (LAN) can exploit this vulnerability by sending crafted input to the SQL handling function [1]. No prior authentication or user interaction is required. The attacker can inject arbitrary SQL commands to interact with the database.

Impact

Successful exploitation allows the attacker to read, modify, and delete database contents [1]. This compromises confidentiality, integrity, and availability of the device's data, potentially leading to full control over the router's database and related services.

Mitigation

ASUS has released firmware version 3.0.0.4.386.45934 to fix this vulnerability [1]. Users should update their RT-AX56U firmware to this version or later. No workarounds are documented; updating is the recommended mitigation.