Malware damaging ASUS routers?

[niftyas]

Hi all, just curious would this still be an issue if the router was on the latest firmware patch already?

Mine decided to kick the bucket yesterday and only stumbled across this post (wifis dead, everything else works and logs complain about getting crda(?) info but timing out. It’s the RT-AX86U.

Thanks for this pretty awesome community!

 

[RMerlin]

Hi all, just curious would this still be an issue if the router was on the latest firmware patch already?

The root cause is a hacker getting access to the router and installing its payload. That access method can vary, from being a vulnerability in older AiCloud versions, up to people simply having weak, easily brute-forced passwords and leaving webui and/or ssh accessble from the WAN.

So basically, you could be running a bleeding edge firmware version, you would still be at risk if your webui can be reached over the Internet. Or if your web browser was compromised.

 

[niftyas]

Thanks @RMerlin ! I'm on a loan router at the moment... I'm guessing this would help? I'm behind a CGNAT with my ISP would that potentially make a difference too? Thanks for sharing your knowledge with a newbie!

 

[RMerlin]

Thanks @RMerlin ! I'm on a loan router at the moment... I'm guessing this would help? I'm behind a CGNAT with my ISP would that potentially make a difference too? Thanks for sharing your knowledge with a newbie!

View attachment 68895

If you are behind CGNAT then you should be fine in theory.

Be careful with access restrictions - it requires you to enter the IP address of your LAN PCs in the list below, otherwise you will lose access to your router, and will be forced to do a factory default reset. That option shouldn't be necessary if your router is only accessible from the LAN.