CVE-2021-45756
📋 TL;DR
This vulnerability is a buffer overflow in the blocking_request.cgi component of Asus RT-AC68U and RT-AC5300 routers. Attackers can exploit it remotely without authentication to execute arbitrary code or crash the device. Users with affected router models running vulnerable firmware versions are at risk.
💻 Affected Systems
- Asus RT-AC68U
- Asus RT-AC5300
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete router compromise, credential theft, network traffic interception, and lateral movement into connected devices.
Likely Case
Router crash causing denial of service, potentially requiring physical reset and disrupting network connectivity.
If Mitigated
Limited impact with proper network segmentation and firewall rules preventing external access to router management interfaces.
🎯 Exploit Status
Buffer overflow vulnerabilities in network devices are commonly weaponized. The CWE-120 classification indicates classic buffer overflow exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: RT-AC68U: 3.0.0.4.385.20633 or later, RT-AC5300: 3.0.0.4.384.82072 or later
Vendor Advisory: http://asus.com
Restart Required: Yes
Instructions:
1. Log into router web interface. 2. Navigate to Administration > Firmware Upgrade. 3. Check for updates or manually download latest firmware from Asus support site. 4. Upload and apply firmware update. 5. Router will reboot automatically.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router web interface
Navigate to Administration > System > Enable Web Access from WAN: set to No
Restrict management interface access
allLimit which IP addresses can access router management
Navigate to Firewall > General > Enable Firewall: Yes
Add rules to restrict access to router IP on ports 80/443
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict firewall rules
- Implement network monitoring for suspicious requests to blocking_request.cgi
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under Administration > Firmware UpgradeCheck Version:
From router CLI: nvram get buildno or check web interface System StatusVerify Fix Applied:
Confirm firmware version matches or exceeds patched versions: RT-AC68U >= 3.0.0.4.385.20633, RT-AC5300 >= 3.0.0.4.384.82072📡 Detection & Monitoring
Log Indicators:
- Multiple failed requests to blocking_request.cgi
- Unusual POST requests with long parameters
- Router crash/reboot logs
Network Indicators:
- HTTP requests to /blocking_request.cgi with oversized payloads
- Traffic patterns suggesting buffer overflow attempts
SIEM Query:
http.url:*blocking_request.cgi AND (http.request_body_length>1000 OR http.status_code>=500)