Asus infosrv patch ?

[jim769]

I see Asus has released firmware to fix the infosvr issue but what is the second security issue mentioned below? And does Merlin's firmware also have the latter patched?


Fixed infosvr security issue.
-Fixed Cross-site request forgery security issue

 

[RMerlin]

I see Asus has released firmware to fix the infosvr issue but what is the second security issue mentioned below? And does Merlin's firmware also have the latter patched?


Fixed infosvr security issue.
-Fixed Cross-site request forgery security issue

I have no idea what the second one is, so no, it's not patched. Since it's quite vague and does not refer to any specific CVE, it could be an undiscovered issue.

 

[jim769]

I have no idea what the second one is, so no, it's not patched. Since it's quite vague and does not refer to any specific CVE, it could be an undiscovered issue.

Thanks Merlin.

 

[john9527]

I wonder if that's the old man-in-the-middle vulnerability during an automatic code update?

 

[jim769]

I wonder if that's the old man-in-the-middle vulnerability during an automatic code update?

You mean me ?

 

[john9527]

You mean me ?

LOL....you gave me my good laugh for the day!

 

[jim769]

LOL....you gave me my good laugh for the day!

Always happy to help make someones day better..

 

[MonkY]

http://www.zdnet.com/article/asus-routers-vulnerable-to-network-attack-exploit-published/

Security researcher Joshua Drake published an advisory warning that "all known firmware versions for applicable routers (RT-AC66U, RT-N66U, etc.) are assumed vulnerable."

The bug allows an attacker on the same network to take full administrative control of the router without the need for a password. The only known fix is to disable the troublesome infosvr service by killing the process when the affected device boots. That has to be performed each time the device restarts.

A working exploit was also published alongside the advisory.

While it may not be a major issue for those on private networks at home, those in offices or on public Wi-Fi are most at risk.

We've reached out to Asus but did not hear back at the time of writing.