CVE-2021-3166
📋 TL;DR
This vulnerability allows attackers to upload arbitrary files disguised as firmware updates to ASUS DSL-N14U-B1 routers. When the malicious file uses the specific filename Settings_DSL-N14U-B1.trx, it triggers shutdown procedures for multiple services, causing persistent service outages. Only users of the affected ASUS router model with vulnerable firmware are impacted.
💻 Affected Systems
- ASUS DSL-N14U-B1
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for all router services, requiring physical reset or manual firmware recovery to restore functionality.
Likely Case
Persistent outage of critical router services (DHCP, DNS, firewall, routing) disrupting network connectivity for all connected devices.
If Mitigated
No impact if firmware validation is properly implemented or if vulnerable devices are not internet-facing.
🎯 Exploit Status
Exploit requires only HTTP access to the router's web interface and knowledge of the specific filename pattern.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official ASUS advisory found in provided references
Restart Required: No
Instructions:
Check ASUS support website for firmware updates. If no patch exists, consider replacing the device with a supported model.
🔧 Temporary Workarounds
Disable remote administration
allPrevent external access to router web interface
Access router admin panel → Advanced Settings → Administration → System → Disable 'Enable Web Access from WAN'
Change default credentials
allUse strong, unique admin password
Access router admin panel → Advanced Settings → Administration → System → Change admin password
🧯 If You Can't Patch
- Place router behind another firewall that blocks external access to router management interface
- Replace device with a supported model that receives security updates
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin panel: Advanced Settings → Administration → Firmware Upgrade → Current Firmware VersionCheck Version:
No CLI command; check via web interface as described aboveVerify Fix Applied:
Verify firmware version is no longer 1.1.2.3_805. Attempt to upload test file with Settings_DSL-N14U-B1.trx filename should be rejected.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to firmware upload endpoint with Settings_DSL-N14U-B1.trx filename
- Unexpected service shutdown events in router logs
Network Indicators:
- HTTP traffic to router management port (typically 80/443) with firmware upload patterns
- Sudden loss of router services
SIEM Query:
http.method:POST AND http.uri:"/upload.cgi" AND http.filename:"Settings_DSL-N14U-B1.trx"