ASUS RT-AX55、RT-AX56U_V2 - Format String - 3

Vulnerability

A format string vulnerability exists in the iperf client function API of ASUS RT-AX55 and RT-AX56U V2 routers. The flaw is located in the set_iperf3_cli.cgi module, which fails to properly validate a specific value passed to it, allowing an attacker-controlled format string to be processed. The affected firmware versions are 3.0.0.4.386_50460 for both models [1].

Exploitation

An attacker must have administrator privileges on the device to access the vulnerable API. With such access, the attacker can send a crafted request containing format string specifiers (e.g., %x, %n) to the set_iperf3_cli.cgi endpoint. The lack of validation means that these specifiers are interpreted by the underlying printf-style function, enabling the attacker to read or write arbitrary memory locations [1].

Impact

Successful exploitation allows a remote authenticated administrator to perform arbitrary code execution on the device, execute arbitrary system operations, or cause a denial-of-service condition. This results in full compromise of the router's confidentiality, integrity, and availability [1].

Mitigation

ASUS has released fixed firmware versions to address the vulnerability: RT-AX55 should be updated to 3.0.0.4.386_51948, and RT-AX56U V2 should be updated to 3.0.0.4.386_51948. Users are advised to apply the update as soon as possible. No workarounds are mentioned in the advisory [1].