ASUS RT-AX55

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	[1] 🔗 Proof	External power, reset and Ethernet interfaces permit interruption or reset with physical access; internal changes require enclosure access. Rare is an assessor inference, not a measured incident frequency.
Known vulnerabilities	Rare	[2] [3] 🔗 Proof	Published historical RT-AX55 management vulnerabilities exist; affected builds and patched later releases must be distinguished. Rare is a provisional qualitative mapping pending a common observation window, not measured prevalence.
Prior attacks	Rare	[4] 🔗 Proof	A real ASUS router compromise campaign was reported. Related historical exploitation was reproduced on RT-AX55; the campaign-wide device count is not a model-specific infection count. Rare is a qualitative mapping.
Updatability	Very common	🔗 Proof	ASUS 固件持续更新
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Administration uses credentials; ordinary DHCP, DNS and discovery paths do not establish universal peer authentication. Partial is a service-scope assessment, not a claim of mutual authentication on every interface.
Communications	Encrypted with up-to-date encryption	[5] 🔗 Proof	Conditional supported-configuration assessment: HTTPS administration and WPA3-Personal or WPA2-AES; disable plaintext remote administration and Telnet. Other traffic and actual enabled settings were not inspected.
Storage	Encrypted with up-to-date encryption	[6] 🔗 Proof	At-rest encryption of configuration and credentials on 3.0.0.4.386_53370 is unverified. Published older-firmware extraction is indirect evidence only.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	Router administrator credential changes are documented. Creation and deletion of lower-privilege local management accounts have not been established; an ASUS cloud account alone does not substantiate Full local account management.
Authentication	Basic	🔗 Proof	管理密码为主
Brute-force protection	Basic	🔗 Proof	ASUS documents CAPTCHA after repeated errors and a warning after five incorrect logins. RT-AX55 build-specific applicability and duration have not been verified.
Event logging	Access event logged	[7] [8] 🔗 Proof	Network logs are documented. Historical build 52332 login-event coverage was disputed; 53370 changes logging data handling but does not specify administrator access-event coverage. Current-build access logging remains unverified.
Passwords	Require change after setup	[9] 🔗 Proof	The model quick-start guide creates a router login password. Firmware 3.0.0.4.386_53244 introduced a 10-character minimum; ASUS recommends a factory reset to apply enhancements. Mixed-character complexity enforcement is not established.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	ASUS stock firmware; reviewed release 3.0.0.4.386_53370, 2026-09-04; installation unknown. (Companion App: ASUS Router app; web management also available)
Hardware (CPU / GPU)	CPU: 1.5 GHz quad-core • GPU:
Memory & Storage	Memory: 256 MB RAM • Storage: 128 MB flash
Power, Battery & Charging	Battery: • Power: AC input 110–240 V 50–60 Hz; DC output 12 V, max. 1 A • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Dual-band 2.4/5 GHz Wi-Fi 6; 1 Gigabit WAN; 4 Gigabit LAN
Physical (Dimensions & Mass)	Dimensions: 230 x 134 x 56 mm • Mass: 374 g

Evidence review addendum — 2026-10-24. Public-document review; ratings with evidence gaps remain provisional.

This addendum supersedes earlier inconsistent wording on the same fields. It is based on public documents and the saved website snapshot; no installed device was tested. Historical research below remains historical evidence. Unverified flash protection and interface-specific controls are not verified device facts.

Documented basic information

• 电源: AC input 110–240 V 50–60 Hz; DC output 12 V, max. 1 A Source

Revised security evidence notes

• 闪存存储加密: At-rest encryption of configuration and credentials on 3.0.0.4.386_53370 is unverified. Published older-firmware extraction is indirect evidence only. Source Source
• 防暴力破解: ASUS documents CAPTCHA after repeated errors and a warning after five incorrect logins. RT-AX55 build-specific applicability and duration have not been verified. Source
• 事件日志: Network logs are documented. Historical build 52332 login-event coverage was disputed; 53370 changes logging data handling but does not specify administrator access-event coverage. Current-build access logging remains unverified. Source Source Source
• 密码规则: The model quick-start guide creates a router login password. Firmware 3.0.0.4.386_53244 introduced a 10-character minimum; ASUS recommends a factory reset to apply enhancements. Mixed-character complexity enforcement is not established. Source Source
• 已知硬件篡改: External power, reset and Ethernet interfaces permit interruption or reset with physical access; internal changes require enclosure access. Rare is an assessor inference, not a measured incident frequency. Source Source
• 既往攻击: A real ASUS router compromise campaign was reported. Related historical exploitation was reproduced on RT-AX55; the campaign-wide device count is not a model-specific infection count. Rare is a qualitative mapping. Source Source
• 与其他系统认证: Administration uses credentials; ordinary DHCP, DNS and discovery paths do not establish universal peer authentication. Partial is a service-scope assessment, not a claim of mutual authentication on every interface. Source
• 账号管理: Router administrator credential changes are documented. Creation and deletion of lower-privilege local management accounts have not been established; an ASUS cloud account alone does not substantiate Full local account management. Source
• 通信加密: Conditional supported-configuration assessment: HTTPS administration and WPA3-Personal or WPA2-AES; disable plaintext remote administration and Telnet. Other traffic and actual enabled settings were not inspected. Source Source
• 已知漏洞: Published historical RT-AX55 management vulnerabilities exist; affected builds and patched later releases must be distinguished. Rare is a provisional qualitative mapping pending a common observation window, not measured prevalence. Source Source Source

Scoring status

Existing selected scores are a saved comparison baseline, not newly validated final scores. Recheck version, region and assessment path before updating options. Recalculate CATS/GRAS and synchronize this section after all selected options are settled. Do not infer a secure or insecure flash state from a downloadable firmware image or encrypted data volumes.

---

Assessment reviewed 2026-10-22. Documented capability assessment with explicitly labelled assessor inferences; no individual installed device was tested.

Assessment scope

Stock RT-AX55. Latest release visible in the reviewed model page: 3.0.0.4.386_53370, 2026-09-04. No physical device or installed configuration was inspected.

The rubric has no numerical frequency thresholds. Qualitative mappings are explained in each comment; an inferred risk rating is not a measured incident rate. Configuration benefits apply only when the specified controls are enabled.

The date is the scheduled Japan retail release announced by ASUS Japan, 22 January 2021, not a worldwide first-launch claim. ASUS Japan launch announcement

Previous calculation

The old submitted score arrays have been withdrawn because they differ from the saved structured-field snapshot. Recalculate from the final selected fields after pending scoring decisions.

Evidence and inference notes

• Known hardware tampering: ASSESSOR INFERENCE: Rare denotes a local-access barrier. Reset, power and Ethernet controls permit configuration changes or service interruption by a physically present person; no tamper-proof certification or measured incident frequency is claimed. RT-AX55 user guide E21014 ASUS setup and reset FAQ
• Known vulnerabilities: ASSESSOR INFERENCE: Very common reflects recurring independent published management weaknesses and command injection, not measured prevalence. Historical affected firmware and patched current releases are distinguished below. ASUS security advisories GreyNoise original RT-AX55 research Current TWCERT/CC CVE-2023-39238 notice
• Prior attacks: ASSESSOR INFERENCE: Rare represents the verified ASUS campaign relevant to this model. GreyNoise observed real compromised ASUS routers and reproduced the related path on RT-AX55 3.0.0.4.386.51598. Its fleet total is not an RT-AX55 infection count. GreyNoise ASUS campaign GreyNoise original RT-AX55 research
• Updatability: Several official firmware releases were published during 2026. RT-AX55 firmware
• Authentication with other systems: Partial describes the service set: administration requires credentials, while DHCP/DNS and network discovery do not universally authenticate peers. This does not claim mutual authentication for every attached system. RT-AX55 user guide E21014
• Communications: Conditional management/Wi-Fi scope: use HTTPS-only administration and WPA3-Personal or WPA2-AES; disable Telnet and plaintext remote administration. These supported settings justify the protected-channel rating. HTTP mode, legacy Wi-Fi and discovery traffic are excluded; this is not an inspected installation. RT-AX55 specifications RT-AX55 user guide E21014
• Storage: ASSESSOR INFERENCE, firmware-code flash scope: published stock RT-AX55 firmware research extracts an ordinary filesystem and analyses executable/NVRAM use. No encryption is a limited firmware-code assessment, not proof that every credential is plaintext. The directly analysed historical build is 3.0.0.4.386.51598. Original RT-AX55 stock firmware analysis GreyNoise original RT-AX55 research
• Account management: An administrator credential is documented; full local role management was not demonstrated. RT-AX55 user guide E21014
• Authentication: Local management uses username/password; local MFA was not established. RT-AX55 user guide E21014
• Brute-force protection: ASSESSOR INFERENCE: Basic denotes the configurable login CAPTCHA, which impedes automated guessing. The control is documented; no universal model/build-specific attempt count or lockout duration is claimed. ASUS login CAPTCHA control RT-AX55 firmware
• Event logging: System Log records network activity; exhaustive administrator-access auditing is not established. RT-AX55 user guide E21014
• Passwords: Setup creates a router login/password. Firmware 3.0.0.4.386_53244 introduced a ten-character minimum, recommending reset to apply it. This maps to the setup-password bucket; length alone does not prove enforced mixed-character complexity. RT-AX55 quick setup guide RT-AX55 firmware

Historical vulnerabilities and remediation

CVE-2023-39780: Authenticated command injection

• Affected scope: RT-AX55 3.0.0.4.386.51598 explicitly documented by original researchers; wider range unverified.

• Preconditions: Reachable management service and an authenticated session; initial-access flaws are separate.

• Impact: System commands and persistent unauthorized configuration.

• Remediation: Vendor fixes reported; first fully fixed build across related paths not established here. Use current official firmware; existing backdoor settings require separate review.

• Severity: Numeric score not independently verified; omitted.

• Evidence: GreyNoise ASUS campaign GreyNoise original RT-AX55 research RT-AX55 firmware

CVE-2023-39238: Authenticated format-string flaw

• Affected scope: Current TWCERT/CC notice lists RT-AX55 3.0.0.4.386_50460. Do not infer all earlier builds.

• Preconditions: Remote attacker with administrator privileges, current CNA notice.

• Impact: Code execution or service disruption.

• Remediation: RT-AX55 3.0.0.4.386_51948.

• Severity: CVSS 3.1: 7.2; AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, current TWCERT/CC.

• Evidence: Current TWCERT/CC CVE-2023-39238 notice ASUS security advisories