CVE-2023-28702: ASUS RT-AC86U Firmware RCE Vulnerability

CVE-2023-28702 Overview

CVE-2023-28702 is a command injection vulnerability affecting ASUS RT-AC86U routers. The device's web interface fails to properly filter special characters in parameters passed through specific web URLs. This allows a remote attacker with normal user privileges to inject and execute arbitrary system commands on the affected device. Successful exploitation can lead to complete system compromise, service disruption, or termination of critical services.

Critical Impact

Authenticated attackers can execute arbitrary system commands on ASUS RT-AC86U routers, potentially gaining full control over the device, intercepting network traffic, or using the compromised router as a pivot point for further attacks.

Affected Products

• ASUS RT-AC86U Firmware version 3.0.0.4.386.51255
• ASUS RT-AC86U hardware devices

Discovery Timeline

• 2023-06-02 - CVE-2023-28702 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-28702

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The ASUS RT-AC86U router's web management interface accepts user-supplied input through specific URL parameters without adequate sanitization or filtering of shell metacharacters.

When a user submits a request containing specially crafted input, the router's web application processes these parameters and passes them directly to underlying system commands. Because the input is not properly sanitized, an attacker can embed shell metacharacters (such as ;, |, &&, or backticks) to break out of the intended command context and inject additional commands that execute with the privileges of the web service process.

The attack requires network access and valid user credentials (low privileges), making it exploitable by any authenticated user on the network. Given that many home and small business routers use default or weak credentials, this significantly increases the practical exploitability of this vulnerability.

Root Cause

The root cause of this vulnerability lies in improper input validation within the ASUS RT-AC86U firmware's web application layer. The affected code paths fail to sanitize special characters before incorporating user-supplied input into OS commands. This is a classic command injection pattern where untrusted data flows directly into command execution functions without proper encoding or escaping.

The firmware does not implement a whitelist-based validation approach for URL parameters, nor does it properly escape shell metacharacters before passing values to system shell interpreters. This allows attackers to terminate the intended command and append malicious commands of their choosing.

Attack Vector

The attack is network-based and requires the attacker to have valid authentication credentials for the router's web interface. The attack flow involves:

1. The attacker authenticates to the ASUS RT-AC86U web management interface using valid low-privilege credentials
2. The attacker crafts a malicious HTTP request targeting the vulnerable URL endpoint
3. Special characters and shell commands are embedded within URL parameters
4. The router's web application processes the request without sanitizing the malicious input
5. The injected commands execute on the underlying Linux-based operating system with elevated privileges
6. The attacker can now execute arbitrary commands, exfiltrate data, modify configurations, or disrupt services

The vulnerability allows for arbitrary command execution, which can be leveraged to install backdoors, modify routing tables, intercept traffic, or completely disable the device.

Detection Methods for CVE-2023-28702

Indicators of Compromise

• Unexpected outbound connections from the router to external IP addresses
• Unusual processes running on the router detected via administrative interfaces
• Modified configuration files or unexpected changes to router settings
• Unexplained service restarts or system instability
• Presence of unauthorized user accounts or modified credentials

Detection Strategies

• Monitor HTTP access logs for requests containing shell metacharacters (;, |, &&, `, $()) in URL parameters
• Implement network-level IDS/IPS rules to detect command injection patterns in traffic destined for router management interfaces
• Deploy SentinelOne Singularity to detect anomalous network behavior and command execution patterns
• Establish baseline behavior for router management traffic and alert on deviations

Monitoring Recommendations

• Enable verbose logging on the ASUS RT-AC86U if available and forward logs to a SIEM
• Monitor for unusual DNS queries or network connections originating from the router
• Implement network segmentation to limit exposure of router management interfaces
• Regularly audit user accounts and access logs on the router

How to Mitigate CVE-2023-28702

Immediate Actions Required

• Update ASUS RT-AC86U firmware to the latest version available from ASUS support
• Change default credentials and enforce strong, unique passwords for all router accounts
• Restrict access to the router's web management interface to trusted networks or specific IP addresses
• Disable remote management if not required for business operations

Patch Information

ASUS has addressed this vulnerability in firmware updates following the disclosure. Administrators should visit the official ASUS support website and download the latest firmware version for the RT-AC86U model. The TW-CERT Security Advisory provides additional details regarding affected versions and remediation guidance.

Workarounds

• Disable remote web management access entirely if not required
• Implement firewall rules to restrict access to the router's management interface from the WAN side
• Use a VPN to access the router's management interface instead of exposing it directly
• Consider placing the router behind an additional firewall with command injection detection capabilities
• Monitor and limit user accounts with access to the router's web interface

# Example: Restrict management interface access via iptables (if supported)
# Block external access to web management port
iptables -A INPUT -p tcp --dport 80 -i eth0 -j DROP
iptables -A INPUT -p tcp --dport 443 -i eth0 -j DROP
# Allow only trusted internal network
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT