RT-AC88U vulnerabilities

[hasarouter]

Hi,

I have an RT-AC88U, I've been seeing in the AiProtection logs like (I've cut out even offender's IP just in case without their knowledge their PC is controlled by someone else)

As these were blocked by trendmicro, I don't worry so much about these logs, it's rather that it looks like my ip range is actively being probed for vulnerabilities, either because that's how it is for everyone or my ISP has a less tight firewall or whatevs. It's more like the rate of the activity makes me worry about 0days or even Asus being slow to respond with patch or even just me being busy and not noticing there's urgency to patch (given that ASUS does not autoupdate)

I have set no external connections allowed so a service vulnerability probably isn't a worry. This leaves vulnerabilities in the TCP/IP stack or the firewall or or even Trend Micro. In the last few years, how common were these sort of vulnerabilities for Asus routers?

 

[sfx2000]

As these were blocked by trendmicro

TrendMicro works...

It does alarm a bit, just to show it's doing the job like a good little puppy...

WAN is full of script kiddies and mass scanners these days - look at the services you have exposed, and consider the threat surface from there...

 

[hasarouter]

TrendMicro works...

It does alarm a bit, just to show it's doing the job like a good little puppy...

WAN is full of script kiddies and mass scanners these days - look at the services you have exposed, and consider the threat surface from there...

No services exposed but this doesn't mean I'm safe - eg TCP/IP stack vulnerabilities are exposed from time to time

 

[sfx2000]

No services exposed but this doesn't mean I'm safe - eg TCP/IP stack vulnerabilities are exposed from time to time

NAT, the SPI firewall, and TrendMicro - as long as not exposing ports/services of the router itself, you're generally safe...

NAT - protects hosts due to private routing of the LAN clients
SPI - protects the router, and some services that might be forwarded
TrendMicro - takes a closer look and based on known profile/signatures, drops packets...

Asus tries to do a belt and suspenders approach to the gateway security in the default configuration with NAT/SPI, and TrendMicro helps out a bit...