ASUS manufactures network devices, including routers and wireless repeaters. Some of these devices include the infosvr service, part of the "ASUS Wireless Router Device Discovery Utility". The infosvr service listens on port 9999/UDP.
**common.c** in infosvr used in ASUS RT-AC66U and other routers does not properly verify the source MAC address of incoming requests, thereby allowing an attacker on the local network to execute arbitrary commands less than 238 bytes sent to 9999/UDP as root.
Update the firmware to revision 188.8.131.52.376.3754 or newer. Manually check the firmware version because the router's "Check for Update" functionality may not work properly.
The exploit attempt must be launched from the same local network as the target.
Exploit was tested on ASUS RTN66U with firmware version 184.108.40.206.376_1071.