Asus Router (Multiple Models)
From Wiki-IoT
Revision as of 15:08, 25 October 2026 by RuiQin (talk | contribs) (Asus routers (multiple models) were compromised by the AyySSHush campaign, which exploited CVE-2023-39780 and auth bypasses to implant persistent SSH backdoors in NVRAM on 9,000+ devices. Firmware upgrades alone do not remove the backdoor.)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
| Asus Router (Multiple Models) | ||
|---|---|---|
|
Security Grade
Calculator v
|
Asus Router (Multiple Models)
Brand: Asus (Parent: ASUSTeK Computer Inc.) Category: Router • Model / Gen: RT-AC3100 / RT-AC3200 / RT-AX55 Multiple (Affected Models) Release Date: 2025-05-28 • Status: In sale Classification Date: • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | 🔗 Proof | No physical tamper mechanism reported; attack is remote. |
| Known vulnerabilities | Very common | 🔗 Proof | CVE-2023-39780 (authenticated command injection); multiple other flaws exploited in WrtHug campaign. |
| Prior attacks | Very common | 🔗 Proof | Over 9,000 routers compromised by AyySSHush; 50,000+ by WrtHug operation. |
| Updatability | Very common | — | Firmware updates available, but do NOT remove existing SSH backdoor; manual cleanup required. |
| Category Score | Score: 3 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | No | 🔗 Proof | Attackers enabled SSH on port 53282 and added their own public key using legitimate ASUS features. |
| Communications | Encrypted with up-to-date encryption | 🔗 Proof | No specific transport encryption flaw disclosed; attack leverages auth bypass and command injection. |
| Storage | No encryption | 🔗 Proof | Backdoor stored in NVRAM in plaintext; survives reboots and firmware upgrades. |
| Category Score | Score: 3 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Absent | 🔗 Proof | Attackers added unauthorized SSH keys via exploited command injection; no admin consent needed. |
| Authentication | Absent | 🔗 Proof | Auth bypasses and CVE-2023-39780 used to gain root-level access without valid credentials. |
| Brute-force protection | Absent | 🔗 Proof | Not relevant; attackers used auth bypass and command injection, not brute-force. |
| Event logging | Absent | [t https://securityaffairs.com/178413/malware/new-ayysshush-botnet-compromised-over-9000-asus-routers-adding-a-persistent-ssh-backdoor.html 🔗 Proof] | Attackers explicitly disabled logging and Asus AiProtection to evade detection. |
| Passwords | Default/Common/Easy to guess | 🔗 Proof | Auth bypass rendered passwords irrelevant for initial access; out-of-box configs targeted. |
| Category Score | Score: 3 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | ASUSWRT (Companion App: ASUS Router App) |
| Hardware (CPU / GPU) | CPU: Varies by Model • GPU: None |
| Memory & Storage | Memory: Varies by Model • Storage: nternal Flash (NVRAM for persistent config) |
| Power, Battery & Charging | Battery: None • Power: DC Power Adapter • Charging: None |
| Display & Camera | Display: None • Camera: None |
| Sound & Connectivity | Sound: Unknown • Connectivity: Ethernet (WAN/LAN), Wi-Fi (2.4GHz/5GHz) |
| Physical (Dimensions & Mass) | Dimensions: N/A • Mass: N/A |
Student assignment submission for IoT security assessment.
