ASUS RT Password Disclosure

`http://dnlongen.blogspot.com/2014/04/CVE-2014-2719-Asus-RT-Password-Disclosure.html  
  
  
In mid February, I wrote that a substantial portion of ASUS wireless  
routers would fail to update their firmware. In fact, the "check for  
update" function would inform the administrator that the router was fully  
up-to-date, even though it was not. ASUS was very quick to fix this. In  
analyzing that issue though, I saw some things that looked like potential  
avenues of exploit.  
  
  
The Web GUI for the ASUS RT- series of routers exposes the administrator  
username and password in clear text. This is true for  
the RT-AC68U, RT-AC68U, RT-AC66R, RT-AC66U, RT-AC56R, RT-AC56U, RT-N66R,  
RT-N66U, RT-N56R, RT-N56U models. I have not tested but suspect the same is  
true of RT-N53, RT-N14U, RT-N16, and RT-N16R since they use the same  
firmware base but a different sub-version. This is CVE-2014-2719.  
  
  
If the administrator is logged in, an attacker can browse to  
<router_address>/Advanced_System_Content.asp and obtain the username and  
password. Another researcher demonstrated a way to access the router  
via embedded images in an email message 18 months ago; that combined with  
this would gain an attacker easy administrative access.  
  
  
Compounding the problem, the admin login does not have a session timeout.  
Thus, if the administrator logged in (such as when first configuring the  
router, or subsequently installing an update) and does  
not intentionally logout, the session remains live and can be exploited as  
described above, even if the administrator no longer has a window open on  
the router.  
  
  
Firmware 3.0.0.4.374.5517 fixes both of these issues. The new code no  
longer shows the current password to users, and there is a new option to  
automatically logout after a set period of time. By default, the router  
will now log the administrator account out after 30 minutes; you can set  
this anywhere from 10 minutes to 999 minutes, or disable the feature if you  
prefer to stay logged in indefinitely.  
  
--   
Regards,  
David Longenecker  
  
Connect: Security Blog <http://dnlongen.blogspot.com> | Security  
Twitter<https://www.twitter.com/dnlongen> |  
Awana Twitter <https://www.twitter.com/dstx_awana> |  
LinkedIn<https://www.linkedin.com/in/dnlongen/>  
  
  
`