To anyone who started seeing strange high CPU and memory usage - Merlin is not affected!

[Volt]

Today I started seeing highly suspicious behavior on my RT-AX56U running stock firmware - constantly high CPU usage leading to the full router lockup that does not go away even after a full reset! I spent hours trying to figure out the cause and even ended up ordering another router because I was sure that there was something wrong with the flash memory. Lately, other users started reporting the same issue in this thread about RT-AX89X and on Reddit, and, at least for now, it looks very concerning (possibly an exploit?). This issue literally makes the router unusable, and who knows how many users are affected!

If I understand correctly, this only affects the stock 386 firmware. To anyone affected by this issue, until Asus finds out and explains what is damn happening, you can flash the Merlin firmware if your router is supported, since it fixes the issue. I tried updating to both 386 and 388 Merlin versions, and both are working fine. Merlin, thanks for always updating various libraries to their latest versions, that is another reason why we (and Asus!) need you!

 

[ColinTaylor]

If the CPU usage is so obvious has anyone tried to see which process is causing it?

 

[Volt]

Looks like asd: https://rog-forum.asus.com/t5/gamin...mory-every-10-minutes-asd-process/td-p/929910. Another user in the topic about RT-AX89X wrote that this process constantly writes 100-300KB/s for some reason.

 

[ColinTaylor]

OK that ties up with with other thread showing a memory leak in the asd process, although they're still just looking at the log after the fact rather than actually investigating it. So likely not an exploit then, more like just a bad signature update.

 

[mpsharp]

Mine started crashing today. Runs out of memory in about 30 minutes and crashes soon after that. Running top right now and watching the "asd" process suck up all the memory. If you kill it, it auto-restarts and you gain yourself another 20 minutes or so!
I found Merlin and this site today and I'm about to reflash my AC5300 as soon as I back up the config.

 

[L&LD]

Your new saved backup config file doesn't travel well from stock to RMerlin firmware.

If you want a stable network/router, flash RMerlin firmware, perform a reset to factory defaults as outlined for your model in the link below, and then do a minimal and manual configuration of the router to secure it and connect to your ISP. Do not use a saved backup config file. Unless it is from the exact router and exact firmware version you're 'restoring' it to.

[Wireless Router] When Standard Reset Isn’t Working: Hard Factory Reset - Models list | Official Support | ASUS Global

 

[gk802]

I hope the fact that the 388 level firmware is unaffected is a feature and not a bug. Looking back at my RT-AX86U currently running 388.2_2, I see that Asus pushed a chknvram20230516 file to /jffs/asd about 3 am on 5/17. I saw no ill effects. Today (5/18), they replaced it with chknvram20210830. Both updates were accompanied by a "restart firewall". Looking at /jffs/asd.log, I see daily "check_version" entries in the log up to 12/4/22, but nothing after. 12/4 is the day I upgraded from 386.7_2 to 388.1.

 

[mpsharp]

FWIW: I saw the issue on both my AC5300 and AC68U (the later in AP mode) with the latest ASUS images. Reflashed both routers with Merlin 386.11 last night. No problems over the last 12 hours.

Note, I didn't need to do a NVRAM reset. Configs were untouched and are working fine.

 

[crashburn162]

I have 4 AX92u with the latest firmware they seem to be unaffected by what ever is going on but my AX56u even though was in AI mesh node mode died yesterday. Also my friends with ax92u older firmware had the same problem. I guess this is global so I expect asus to release a statement . Some say it may be the NTP time server problem changing it may help I will test and comment later.

 

[RMerlin]

People running versions older than 386.10 of my firmware will also most likely be affected. This isn't about my firmware being different, it's about which code base your firmware is using. Stock firmware 386_51xxx will be just as fine as 386.11.

 

[eightiescalling]

OK that ties up with with other thread showing a memory leak in the asd process, although they're still just looking at the log after the fact rather than actually investigating it. So likely not an exploit then, more like just a bad signature update.

Which other thread are you referring to? If it's the one I started a couple of days back I'd say they're different issues - I've not seen the high CPU load and memory increase was slow but steady. (In fact the behaviour was consistent pre-and-post the routers current signature file.)

But yes, I'll happily acknowledge that while I spent a fair bit of time trawling for an idea of what was going on, being far from an asd expert and as it was abnormal behaviour not yet impacting the router I wasn't at the stage of wanting to try anything too drastic that could have then urgently needed more time to unpick than I had. No point in treating everything as a sev 1 when doing so could actually make it so...

 

[ColinTaylor]

Which other thread are you referring to? If it's the one I started a couple of days back I'd say they're different issues...

The link in post #2 showed the asd process reaching 625,440kB and crashing the router. That sounded like what you described. But if your problem predates the bad signature update then they would indeed appear to be two different issues.

 

[RickNY]

I have two RP-AC55 extenders that I use in Media Bridge mode, and also started experiencing this same issue.. After several minutes, 100% CPU usage and then they crash. Out of nowhere.