CVE-2023-47678
📋 TL;DR
An improper access control vulnerability in ASUS RT-AC87U routers allows attackers to read or write files via TFTP connections. This affects all versions of the RT-AC87U router. Attackers can potentially access sensitive files or modify system files without authentication.
💻 Affected Systems
- ASUS RT-AC87U
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise including credential theft, persistent backdoor installation, and network-wide access to connected devices.
Likely Case
Unauthorized file access leading to configuration theft, credential harvesting, or limited file modification.
If Mitigated
No impact if TFTP access is properly restricted or disabled.
🎯 Exploit Status
Exploitation requires TFTP access to the router, which may be enabled by default or through specific configurations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None available
Vendor Advisory: https://www.asus.com/event/network/EOL-product/
Restart Required: No
Instructions:
No official patch available. The device is End-of-Life. Consider replacement or workarounds.
🔧 Temporary Workarounds
Disable TFTP Service
allDisable the TFTP service on the router to prevent exploitation.
Access router admin interface > Administration > System > Enable TFTP Server: Disable
Restrict TFTP Access
allConfigure firewall rules to restrict TFTP access to trusted IP addresses only.
Access router admin interface > Firewall > General > Add rules to block TFTP (port 69) from untrusted sources
🧯 If You Can't Patch
- Replace the router with a supported model that receives security updates
- Isolate the router in a separate network segment with strict access controls
🔍 How to Verify
Check if Vulnerable:
Check if TFTP service is enabled on port 69: Use 'nmap -p 69 <router_ip>' or attempt TFTP connection to the router.Check Version:
Log into router admin interface > Administration > Firmware Upgrade to see current versionVerify Fix Applied:
Verify TFTP service is disabled: Attempt TFTP connection to port 69 should fail. Check router admin interface TFTP settings.📡 Detection & Monitoring
Log Indicators:
- Unusual TFTP connection attempts in router logs
- File access/modification events via TFTP
Network Indicators:
- TFTP traffic to router on port 69 from unexpected sources
- Multiple failed TFTP connection attempts
SIEM Query:
source="router_logs" AND (tftp OR port_69) AND (access OR connection)