ASUS RT-AC86U - Command injection vulnerability - 2

Vulnerability

A command injection vulnerability exists in the AiProtection security-related function of the ASUS RT-AC86U router running firmware version 3.0.0.4.386.51529 [1]. The function does not properly filter special characters, allowing injection of arbitrary commands through specially crafted input [1].

Exploitation

A remote attacker with regular user privileges can exploit this vulnerability by sending a crafted request to the AiProtection feature [1]. No additional authentication beyond a valid user session is required, and the attack can be carried out over the network without user interaction [1].

Impact

Successful exploitation allows the attacker to perform command injection, executing arbitrary system commands on the router [1]. This can lead to full compromise of confidentiality, integrity, and availability: the attacker can read sensitive data, alter device configuration, disrupt services, or terminate system processes [1]. The impact is considered high across all CIA triad components according to the CVSS score of 8.8 [1].

Mitigation

ASUS has released firmware version 3.0.0.4.386.51915, which fixes the vulnerability [1]. Users should update their RT-AC86U devices to this version or later. No workaround is provided in the available references [1].