ASUS RT-AX88U - Format String

Vulnerability

ASUS RT-AX88U routers running firmware versions prior to 3.0.0.4.386.4606 contain a format string vulnerability in the web management interface [1]. The flaw allows an attacker to supply arbitrary format specifiers in HTTP requests, leading to uncontrolled memory writes.

Exploitation

An unauthenticated attacker with network access to the router can exploit this vulnerability by sending a crafted HTTP request containing format string specifiers. No authentication or user interaction is required [1]. The attacker does not need any prior access privileges.

Impact

Successful exploitation enables an attacker to write to arbitrary memory addresses, leading to remote code execution with full system privileges. This can result in complete compromise of the device, including arbitrary system operations, data exfiltration, or denial of service [1].

Mitigation

ASUS has released firmware version 3.0.0.4.386.46065 to fix this vulnerability. Users should update their RT-AX88U to the latest firmware immediately. No known workarounds exist [1].