ASUS Router infosvr Service Remote Command Execution Vulnerability

Added: 01/13/2015
CVE: CVE-2014-9583
BID: 71889
OSVDB: 116691

Background

ASUS manufactures network devices, including routers and wireless repeaters. Some of these devices include the infosvr service, part of the “ASUS Wireless Router Device Discovery Utility”. The infosvr service listens on port 9999/UDP.

Problem

The file **common.c** in infosvr used in ASUS RT-AC66U and other routers does not properly verify the source MAC address of incoming requests, thereby allowing an attacker on the local network to execute arbitrary commands less than 238 bytes sent to 9999/UDP as root.

Resolution

Update the firmware to revision 3.0.0.4.376.3754 or newer. Manually check the firmware version because the router’s “Check for Update” functionality may not work properly.

References

<http://www.pcworld.com/article/2867252/exploit-allows-asus-routers-to-be-hacked-from-local-network.html&gt;
<http://www.zdnet.com/article/asus-routers-vulnerable-to-network-attack-exploit-published/&gt;
<https://github.com/jduck/asus-cmd&gt;

Limitations

The exploit attempt must be launched from the same local network as the target.

Exploit was tested on ASUS RTN66U with firmware version 3.0.0.4.376_1071.