RT-AC88U port 80/8443 closed, recovery fails at 32MB

  • ATTENTION! As of November 1, 2020, you are not able to reply to threads 6 months after the thread is opened if there are more than 500 posts in the thread.
    Threads will not be locked, so posts may still be edited by their authors.
    Just start a new thread on the topic to post if you get an error message when trying to reply to a thread.


New Around Here
Hey there, long-time reader here, finally created an account for this issue. I just can't get this router to work.
Story is: I bought a customer returned Asus RT-AC88U, which was sent to the manufacturer for, according to the label, "missing parts". Since the customer got a new unit directly, this one got sold off real cheap.
Problem is: The setup page is not reachable, port 80 is closed. I tried resetting it with the WPS-button, didn't change anything. Firmware restoration utility will either fail early or *always* right after hitting 33553408 Bytes (32 MB). I have tried different firmware images, official and Merlin. Both will fail at 32 MB or earlier. Also tried different ports and combinations of WPS reset/recovery mode.

The router opens a public hotspot, named "ASUS_40_5G". Only on 5 GHz, 2.4 is not on. Other than that, the Power LED is on solid, WAN LED is solid red, as long as nothing is plugged in to the WAN port. The device reports as RT-AC88U-1740. I did a port scan on it, the following ports are open:
53 (DNS)
515 (?)
1990 - Returns HTTP1.1 404 Not Found (Plain text, not HTML)
3394 (?)
3838 (?)
5473 - Connection reset
9100 (?)
9998 (?)
18017 - Redirects to login page https://router.asus.com/QIS_default.cgi?flag=welcome which will fail to load
55329 - Returns <html class=" kmbsbnb idc0_320"><head><title>404 Not Found</title> [...] with varying first class element in html, "idc0_320" is persistent.

Am I missing something? Any help would be much appreciated, I wouldn't want to return it.


New Around Here
Thanks for the reply. SSH won't work on any of the ports. I invested yesterdays evening to drill down on it more, but didn't find anything meaningful. Tried SSH/netcat/telnet on all open ports, but got nothing in return.
The most interesting data is from those two:
18017 http Asus wanduck WAN monitor httpd
42361 upnp MiniUPnP 1.9 (AsusWRT; UPnP 1.1) Service Info: Device: WAP; CPE: cpe:/o:asus:asuswrt:

I also found an open port on UDP 5351, reported as nat-pmp.

Was hoping to maybe find a way in with the system version, but is used for all current versions, so...

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!