Disabling NAT-PMP on GT-AX11000

[Doug Nix]

I use Fing to monitor my network. Recently, I ran a router vulnerability scan and got a message that my router allows unchecked NAT-PMP port forwarding. I went hunting for guidance and found this:

[Wireless] How to disable NAT-PMP from ASUS Router?​

[Wireless Router] How to disable NAT-PMP from ASUS Router? | Official Support | ASUS Global

I followed the procedure in the FAQ and found that all of the settings on my router were as shown in the ASUS FAQ. The router still fails the Fing scan. Any thoughts on how to correct this problem?

 

[ColinTaylor]

If you have the "Open NAT" tab check that "Enable Port Forwarding" is turned off there as well.

 

[Doug Nix]

Hey, Colin,

I do have OpenNAT, but port forwarding was disabled. I‘m also usIng symmetrical NAT, not full-cone.

 

[ColinTaylor]

Sounds like it could be a false positive:

Reddit - Dive into anything

community.fing.com

 

[Doug Nix]

Thanks, @ColinTaylor. I'd searched the Fing fora, but somehow I missed that post. I've added my voice to the thread. If I hear of a fix from Fing, I'll post the details in this thread.

 

[Doug Nix]

Here’s the workaround. It’s not clear to me whether or not there is a real NAT-PMP vulnerability here.

it seems to be related to the Aura RGB feature on the router. Aura RGB let’s you run colours and patterns on the router’s RGB LEDs. Fun, but not anything more than window dressing. From the web UI, disable the Aura RGB function.

Start by logging in to the router using SSH or telnet. At the command line enter:

nvram get aurasync_enable

If the result is = 1, then the Aura function is still enabled. To fix that, enter:

nvram set aurasync_enable=0
commit

The commit command will make sure that the change persists after a reboot. You can check that the parameter is correctly set by running the first command again. It should come back = 0.

Reboot the router.

Once the router is back up, open FING and run the router vulnerability test in Fing’s Security tab. It should come back without any errors now.

 

[Doug Nix]

I’ve finally been able to report this as a potential security vulnerability to ASUS via their vulnerability reporting site. We'll see if they respond. If I hear anything from them I will update this thread with details.

 

[Doug Nix]

On May 16, 2022 I received an email from ASUS Security that included a link to download a beta firmware version that corrects the problem with the apparent NAT-PMP vulnerability. I've installed and tested the firmware, and it appears to do the trick. Here's the link: https://www.asuswebstorage.com/navigate/a/#/s/E01336E2A1D645678E142FFC3F5A160FY

Not sure if/when these changes will be included in the production version of the firmware.