CVE-2023-35087
📋 TL;DR
A format string vulnerability in ASUS AiMesh system allows unauthenticated remote attackers to execute arbitrary code on affected routers. This affects ASUS RT-AX56U V2 and RT-AC86U routers with specific vulnerable firmware versions. Attackers can gain full control of the device without authentication.
💻 Affected Systems
- ASUS RT-AX56U V2
- ASUS RT-AC86U
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to install persistent malware, intercept all network traffic, pivot to internal networks, or brick the device.
Likely Case
Remote code execution leading to device takeover, credential theft, and use as attack platform for further network intrusion.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and AiMesh features disabled.
🎯 Exploit Status
Format string vulnerabilities typically have low exploitation complexity. No authentication required makes this particularly dangerous.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check ASUS support site for latest firmware updates
Vendor Advisory: https://www.twcert.org.tw/tw/cp-132-7249-ab2d1-1.html
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to Administration > Firmware Upgrade. 3. Check for updates. 4. Download and install latest firmware. 5. Reboot router after installation.
🔧 Temporary Workarounds
Disable AiMesh
allDisable AiMesh functionality to remove attack vector
Navigate to AiMesh > System Settings > Disable AiMesh
Restrict WAN Access
allBlock external access to router management interface
Configure firewall to block WAN access to router ports (typically 80, 443, 8443)
🧯 If You Can't Patch
- Place router behind firewall with strict inbound rules
- Disable remote management and AiMesh features
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface under Administration > Firmware UpgradeCheck Version:
Login to router web interface and check firmware versionVerify Fix Applied:
Verify firmware version is newer than affected versions listed in advisory📡 Detection & Monitoring
Log Indicators:
- Unusual process execution
- Failed authentication attempts to AiMesh services
- Format string error messages in system logs
Network Indicators:
- Unusual outbound connections from router
- Traffic to unexpected ports from router
- AiMesh protocol anomalies
SIEM Query:
source="router" AND (event="format_string" OR process="cm_processChangedConfigMsg" OR service="AiMesh")