ASUS routers contain a vulnerability that turns users into admins, according to security researcher Joshua Drake.
Routers could be exploited by malicious local users, but not by those on the wider internet. After the malicious user intervenes, the router could send network users using it to malicious websites.
Drake mentions in a post that several popular models such as the RT-N66 and RT-AC66U are affected.
“Currently, all known versions of the firmware used in these routers are considered vulnerable,” Drake said.
[tweet_embed id=552292584450969600]
The flaw that allows command execution is in the infosvr service, which runs as root and listens on UDP port 9999. The service is designed, as Drake says, to simplify router configuration by discovering local routers.
Administrators should remove the remote command execution feature from infosvr or close the service from their firewall, as their passwords on local networks are not secure.
