CVE-2023-34359
📋 TL;DR
This vulnerability allows remote unauthenticated attackers to cause a denial-of-service condition on ASUS RT-AX88U routers by sending a specially crafted request that crashes the httpd service. The crash occurs in the do_json_decode() function when processing malformed JSON data. This affects all users of vulnerable ASUS RT-AX88U routers with exposed web interfaces.
💻 Affected Systems
- ASUS RT-AX88U
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of router functionality requiring physical reboot, potentially disrupting all network connectivity for connected devices until service is restored.
Likely Case
Temporary loss of web interface access and potential disruption of router management functions, requiring router reboot to restore normal operation.
If Mitigated
Minimal impact if router is behind firewall with restricted web interface access or if patched firmware is installed.
🎯 Exploit Status
The vulnerability requires sending a specially crafted HTTP request to trigger the JSON parsing bug, which is relatively simple to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.0.4.388_23285 and later
Vendor Advisory: https://www.asus.com/support/FAQ/1051545/
Restart Required: Yes
Instructions:
1. Log into router web interface. 2. Navigate to Administration > Firmware Upgrade. 3. Download latest firmware from ASUS support site. 4. Upload and install firmware. 5. Wait for automatic reboot.
🔧 Temporary Workarounds
Disable Remote Web Access
allPrevent external access to router web interface by disabling remote administration features.
Navigate to Administration > System > Enable Web Access from WAN: Set to 'No'
Restrict Web Interface Access
allLimit web interface access to trusted IP addresses only using firewall rules.
Navigate to Firewall > General > Enable Firewall: Yes
Add rules to restrict port 80/443 access
🧯 If You Can't Patch
- Place router behind a firewall that blocks all inbound HTTP/HTTPS traffic to the router's management interface
- Disable the web interface entirely and use only command-line or other management interfaces if available
🔍 How to Verify
Check if Vulnerable:
Check current firmware version in router web interface under Administration > Firmware Upgrade > Firmware VersionCheck Version:
curl -s http://router.asus.com/ | grep -i firmwareVerify Fix Applied:
Verify firmware version is 3.0.0.4.388_23285 or later and test web interface functionality remains stable after sending various HTTP requests📡 Detection & Monitoring
Log Indicators:
- Multiple httpd process crashes in system logs
- Unusual HTTP requests to router web interface with malformed JSON data
- Repeated connection attempts to router management ports
Network Indicators:
- Unusual HTTP traffic patterns to router IP on port 80/443
- Multiple failed web interface connections followed by service unavailability
SIEM Query:
source="router.logs" AND ("httpd crashed" OR "do_json_decode" OR "segmentation fault")