ASUS RT-AX56U V2 & RT-AC86U - Format String - 2

Vulnerability

A format string vulnerability exists in the cm_processREQ_CHANGED_CONFIG function within the AiMesh system of ASUS RT-AX56U V2 (firmware 3.0.0.4.386_50460) and RT-AC86U (firmware 3.0.0.4_386_51529). The function cm_processChangedConfigMsg fails to properly validate a specific value before using it as a format string argument, allowing an attacker to inject arbitrary format specifiers [1].

Exploitation

An unauthenticated remote attacker can exploit this vulnerability over the network without requiring any prior privileges or user interaction. The attacker sends a crafted request to the AiMesh service that includes malicious format string tokens within the affected parameter. The lack of input validation causes the function to interpret these tokens, leading to memory corruption [1].

Impact

Successful exploitation enables arbitrary code execution with root privileges on the device. The attacker can perform arbitrary system operations, disrupt services, or fully compromise the router. This constitutes a complete compromise of confidentiality, integrity, and availability [1].

Mitigation

ASUS has released firmware updates to address this issue: RT-AX56U V2 should be updated to version 3.0.0.4_386_51598, and RT-AC86U should be updated to version 3.0.0.4.386_51915 [1]. No workarounds are documented; users are advised to apply these updates immediately.