ASUS RT-AC86U - Command Injection

Vulnerability

The ASUS RT-AC86U router (firmware version v3.0.0.4.386.45956 and earlier) contains a command injection vulnerability in its Line Printer Daemon (LPD) service. The service does not properly filter special characters in user-supplied requests, making the code path reachable by any network request to the LPD port [1].

Exploitation

An unauthenticated attacker on the same local area network (LAN) can send a crafted request to the LPD service without any prior authentication or user interaction. The lack of special-character filtering allows the attacker to inject arbitrary system commands into the request, which are then executed by the underlying operating system [1].

Impact

Successful exploitation enables the attacker to execute arbitrary commands with the privileges of the LPD process, leading to full compromise of confidentiality, integrity, and availability. The attacker can read or modify sensitive data, install malware, or disrupt or terminate the LPD service, causing a denial of service [1].

Mitigation

ASUS released firmware version 3.0.0.4.386.46092 to address this vulnerability. Users should update their RT-AC86U routers to this version or later. No workaround is available if the firmware cannot be updated [1].