CVE-2023-28703
📋 TL;DR
A stack-based buffer overflow vulnerability in ASUS RT-AC86U routers allows remote attackers with administrator privileges to execute arbitrary system commands. This affects ASUS RT-AC86U routers running vulnerable firmware versions. Attackers can disrupt services or take full control of affected devices.
💻 Affected Systems
- ASUS RT-AC86U
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing persistent remote access, data exfiltration, and use as pivot point into internal networks
Likely Case
Service disruption, configuration changes, or installation of malware on the router
If Mitigated
Limited impact if strong network segmentation and monitoring are in place
🎯 Exploit Status
Requires administrator credentials but buffer overflow exploitation is well-understood
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.0.4.386.51255 or later
Vendor Advisory: https://www.asus.com/support/FAQ/1046354/
Restart Required: Yes
Instructions:
1. Log into router web interface. 2. Navigate to Administration > Firmware Upgrade. 3. Upload firmware version 3.0.0.4.386.51255 or later. 4. Wait for upgrade to complete. 5. Router will reboot automatically.
🔧 Temporary Workarounds
Disable remote administration
allPrevent external access to router administration interface
Restrict admin access
allLimit administration interface access to specific IP addresses
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict firewall rules
- Implement network monitoring for suspicious admin interface access
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under Administration > Firmware UpgradeCheck Version:
No CLI command - check via web interface at 192.168.1.1 (default)Verify Fix Applied:
Confirm firmware version is 3.0.0.4.386.51255 or later📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful admin login
- Unusual CGI function calls in router logs
Network Indicators:
- Unusual traffic patterns from router to external IPs
- Multiple malformed HTTP requests to admin interface
SIEM Query:
source="router_logs" AND (event="admin_login" OR event="cgi_execution") AND status="success"