ASUS Pushes Emergency Firmware Rollout, Patches Critical Router Vulnerabilities

Taiwanese tech giant ASUS has issued an urgent security advisory after the discovery of multiple severe vulnerabilities in several models of its routers.

An emergency firmware rollout is currently underway to address nine security flaws, with the most significant of these including CVE-2022-26376 and CVE-2018-1160.

The vulnerabilities identified include a critical memory corruption flaw in the Asuswrt firmware for Asus routers and an out-of-bounds write Netatalk weakness. If exploited, either vulnerability could let threat actors gain arbitrary code execution privileges on vulnerable devices. Attackers could also weaponize CVE-2022-26376 to trigger denial-of-service attacks.

The Netatalk weakness is particularly concerning, as the bug is almost five years old and has gone unaddressed until now. ASUS urges customers with affected routers to apply the patches immediately, cautioning that failure to do so could leave them vulnerable to intrusion.

"Please note, if you choose not to install this new firmware version, we strongly recommend disabling services accessible from the WAN side to avoid potential unwanted intrusions," the company warned in its security advisory. "These services include remote access from WAN, port forwarding, DDNS, VPN server, DMZ, port trigger."

The following routers are vulnerable and should be updated immediately:

GT6
GT-AXE16000
GT-AX11000 PRO
GT-AX6000
GT-AX11000
GS-AX5400
GS-AX3000
XT9
XT8
XT8 V2
RT-AX86U PRO
RT-AX86U
RT-AX86S
RT-AX82U
RT-AX58U
RT-AX3000
TUF-AX6000
TUF-AX5400

Users can apply the firmware patches through various channels, including the official ASUS support website, product-specific pages, or links provided in the security advisory.

In addition to installing the new firmware, ASUS encourages its customers to strengthen their security by configuring different passwords for their routers and wireless networks. Users should opt for strong, unique passwords that use a combination of uppercase and lowercase characters, symbols and numbers and avoid password recycling (using the same password for multiple accounts, devices, or services).