ASUS RT-AC86U - Command injection vulnerability - 4

Vulnerability

A command injection vulnerability exists in the Traffic Analyzer - Statistic function of the ASUS RT-AC86U router firmware version 3.0.0.4.386.51529 and possibly earlier versions [1]. The function fails to properly filter special characters in input parameters, allowing an attacker to inject arbitrary operating system commands [1].

Exploitation

A remote attacker must have a regular user account on the router to access the web management interface [1]. The attacker sends crafted HTTP requests to the vulnerable endpoint, injecting shell metacharacters into the input fields of the Traffic Analyzer's statistic function [1]. No additional user interaction or race condition is required; exploitation is straightforward once the attacker is authenticated.

Impact

Successful exploitation allows the attacker to execute arbitrary system commands with root privileges on the router's operating system [1]. This can lead to full compromise of the device, including data disclosure, modification, persistent denial of service, or termination of critical services [1].

Mitigation

ASUS has released firmware version 3.0.0.4.386_51915 to address this vulnerability [1]. Users should update to this fixed version immediately [1]. If the router cannot be updated, consider disabling remote management and limiting access to the web interface to trusted networks as a temporary workaround.