CVE-2023-28702: ASUS RT-AC86U Firmware RCE Vulnerability

CVE-2023-28702 Overview

CVE-2023-28702 is a command injection vulnerability affecting the ASUS RT-AC86U wireless router. The device fails to filter special characters supplied through parameters in specific web URLs exposed by its management interface. A remote attacker holding normal user credentials can inject operating system commands and execute arbitrary code on the underlying router. Successful exploitation allows attackers to run system commands, disrupt router operation, or terminate services. The flaw is classified under [CWE-78] (Improper Neutralization of Special Elements used in an OS Command). The Taiwan TWCERT coordination center published the advisory describing the issue.

Critical Impact
Authenticated remote attackers can execute arbitrary system commands on affected RT-AC86U routers, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

ASUS RT-AC86U router hardware
ASUS RT-AC86U firmware version 3.0.0.4.386.51255
Deployments exposing the router web management interface to attacker-reachable networks

Discovery Timeline

2023-06-02 - CVE-2023-28702 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-28702

Vulnerability Analysis

The RT-AC86U web management interface accepts user-supplied parameters in several URL endpoints without sanitizing shell metacharacters. When the firmware passes these parameters into system command execution routines, an attacker can append additional commands using characters such as ;, &, |, or backticks. The router runs these commands with the privileges of the web server process, which on consumer ASUS firmware is typically root. This converts a low-privileged authenticated session into full device control. The vulnerability requires authentication, but any standard user account is sufficient.

Root Cause

The root cause is missing input validation and improper neutralization of operating system command elements in URL parameter handlers. The firmware concatenates user input directly into command strings passed to a shell interpreter. No allowlist filtering or argument escaping is applied before execution.

Attack Vector

Exploitation occurs over the network against the router web interface. The attacker authenticates with normal user credentials and issues a crafted HTTP request to a vulnerable URL. The injected payload executes when the firmware processes the parameter through a shell call. No user interaction beyond the attacker's own session is required. Refer to the Taiwan TW-CERT Security Advisory for the vendor-coordinated technical details.

Detection Methods for CVE-2023-28702

Indicators of Compromise

HTTP requests to the router management interface containing shell metacharacters such as ;, |, &&, backticks, or $(...) inside URL query parameters
Unexpected outbound connections originating from the router itself to attacker-controlled infrastructure
New or modified files in writable firmware directories such as /tmp or /jffs
Unscheduled router reboots, dropped services, or configuration changes that coincide with administrative login events

Detection Strategies

Inspect router access logs for authenticated sessions issuing requests with non-standard parameter values containing shell control characters
Monitor north-south network traffic for the router's WAN-side IP initiating connections to unusual destinations or ports
Correlate web interface login events with subsequent configuration changes or service restarts

Monitoring Recommendations

Forward router syslog output to a centralized logging or SIEM platform for retention and analysis
Alert on repeated failed authentication attempts against the router admin portal, which often precede exploitation
Baseline normal management traffic and flag deviations such as requests from unexpected source addresses

How to Mitigate CVE-2023-28702

Immediate Actions Required

Apply the latest firmware update published by ASUS for the RT-AC86U platform
Restrict access to the router web management interface to trusted internal networks only and disable remote WAN administration
Rotate all administrator and user account passwords on the device and remove unused accounts
Audit recent configuration changes, DNS settings, and port forwarding rules for signs of tampering

Patch Information

ASUS addressed this issue in firmware updates released after 3.0.0.4.386.51255. Consult the Taiwan TW-CERT Security Advisory and the ASUS support site for the specific fixed firmware version applicable to your hardware revision. Verify the firmware signature after download and install through the official web interface or recovery utility.

Workarounds

Disable web access from the WAN interface and require VPN access for any remote administration
Limit creation of non-administrative user accounts on the router to reduce the pool of credentials that can authenticate to the vulnerable endpoints
Place the router behind a network segment that restricts which client devices can reach the management interface
Replace end-of-support hardware with a currently supported model if ASUS does not release a fix for your firmware branch

bash

# Configuration example: restrict management access to LAN only
# From the ASUS web UI: Administration > System
#   Enable Web Access from WAN: No
#   Enable Telnet: No
#   Enable SSH: LAN only (if remote shell is required)
# Optional firewall rule on an upstream device to block external access to the router admin port
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -i <wan_iface> -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -i <wan_iface> -j DROP