ASUS RT-AX55

From Wiki-IoT


Evidence review: 2026-10-21. Overall IDRS grade: not assigned.

All 12 criteria are investigated below. A documented capability, a historical vulnerability and an observed current configuration are different evidence types. Unresolved values are explicitly not scored; absence of a public report is not evidence of absence.

Classification form fields are stored in this page. The evidence table is displayed while required ratings remain unresolved, so no overall grade is assigned. Blank rating choices mean insufficient evidence, not None or Absent.

Product information

Field Verified value / stated scope
Name ASUS RT-AX55
Brand ASUS
Model RT-AX55
Generation AX1800 Wi-Fi 6
Cpu 1.5 GHz quad-core
Memory 256 MB RAM
Storage 128 MB flash
Dimensions 230 x 134 x 56 mm
Mass 374 g
Operating System ASUS stock firmware; reviewed release 3.0.0.4.386_53370, 2026-09-04; installation unknown.
Connectivity Dual-band 2.4/5 GHz Wi-Fi 6; 1 Gigabit WAN; 4 Gigabit LAN
Companion App ASUS Router app; web management also available
Type Router
Website https://www.asus.com/us/networking-iot-servers/wifi-routers/all-series/rt-ax55/techspec/

Assessment scope

Stock RT-AX55. Latest release visible in the reviewed model page: 3.0.0.4.386_53370, 2026-09-04. No physical device or installed configuration was inspected.

No physical device, installed firmware, password, network trace or storage image was inspected. Conditional capability assessments apply only when the named settings are enabled.

Security evaluation

Device

Criterion Finding / rubric choice Evidence and reasoning
Known hardware tampering Physical exposure documented; not rated The guide documents reset, power and Ethernet interfaces. Physical access can interrupt service or restore configuration; no tampering-frequency statistics or resistance test was verified. RT-AX55 user guide E21014 ASUS setup and reset FAQ
Known vulnerabilities Confirmed vulnerabilities; frequency not quantified The records below establish historical vulnerabilities within the stated firmware scope. They do not measure prevalence or establish a Rare/Very common frequency rating. ASUS security advisories GreyNoise original RT-AX55 research Current TWCERT/CC CVE-2023-39238 notice
Prior attacks Real ASUS campaign; model-specific rate unknown GreyNoise observed actual compromised ASUS routers and reproduced the related command-injection path on RT-AX55 firmware 3.0.0.4.386.51598. Its fleet count is not an RT-AX55 incident count. GreyNoise ASUS campaign GreyNoise original RT-AX55 research
Updatability Very common (CRIS 1; scoped assessment) Several official firmware releases were published during 2026. RT-AX55 firmware

System

Criterion Finding / rubric choice Evidence and reasoning
Authentication with other systems Not rated: insufficient evidence Administration requires credentials; complete mutual authentication across integrations was not established. RT-AX55 user guide E21014
Communications Mixed configurable channels; not rated WPA3 and HTTPS are supported. The manual also permits HTTP administration and optional Telnet; Wi-Fi encryption does not protect every application channel. The installed configuration was not inspected. RT-AX55 specifications RT-AX55 user guide E21014
Storage Not rated: insufficient evidence Encryption at rest for flash-stored credentials and configuration was not established. The methodology refers specifically to device flash, not just user disks, removable media, or encrypted network traffic. RT-AX55 user guide E21014

User authentication

Criterion Finding / rubric choice Evidence and reasoning
Account management Basic (CRIS 2; scoped assessment) An administrator credential is documented; full local role management was not demonstrated. RT-AX55 user guide E21014
Authentication Basic (CRIS 2; scoped assessment) Local management uses username/password; local MFA was not established. RT-AX55 user guide E21014
Brute-force protection Not rated: insufficient evidence Model/build-specific failed-login thresholds were not verified. RT-AX55 user guide E21014
Event logging Partial logging (CRIS 2; scoped assessment) System Log records network activity; exhaustive administrator-access auditing is not established. RT-AX55 user guide E21014
Passwords Setup-created credentials; current policy partly verified The quick guide directs creation of a router login/password. Release 3.0.0.4.386_53244 introduced a ten-character minimum and recommends reset to apply changes. This is a length rule, not proof of mandatory mixed-character complexity on every configuration. RT-AX55 quick setup guide RT-AX55 firmware

Rating calculation

No definitive category score or GRAS is calculated while one or more required CRIS values are unresolved. The method requires taking the ceiling of each complete category mean and summing the three category scores. An unknown must not be substituted with 1 or treated as None. Wiki-IoT methodology

Historical vulnerabilities and remediation

CVE-2023-39780: Authenticated command injection

  • Affected scope: RT-AX55 3.0.0.4.386.51598 explicitly documented by original researchers; wider range unverified.
  • Preconditions: Reachable management service and an authenticated session; initial-access flaws are separate.
  • Impact: System commands and persistent unauthorized configuration.
  • Remediation: Vendor fixes reported; first fully fixed build across related paths not established here. Use current official firmware; existing backdoor settings require separate review.
  • Severity: Numeric score not independently verified; omitted.

CVE-2023-39238: Authenticated format-string flaw

  • Affected scope: Current TWCERT/CC notice lists RT-AX55 3.0.0.4.386_50460. Do not infer all earlier builds.
  • Preconditions: Remote attacker with administrator privileges, current CNA notice.
  • Impact: Code execution or service disruption.
  • Remediation: RT-AX55 3.0.0.4.386_51948.
  • Severity: CVSS 3.1: 7.2; AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, current TWCERT/CC.

Product evidence notes

Retrieved from "http://fehmijaafar.net/wiki-iot/index.php?title=ASUS_RT-AX55&oldid=8667"