CVE-2023-28703: ASUS RT-AC86U Firmware RCE Vulnerability

CVE-2023-28703 Overview

CVE-2023-28703 is a stack-based buffer overflow vulnerability affecting the ASUS RT-AC86U router firmware. The vulnerability exists in a specific CGI function that fails to properly validate the length of network packet headers, allowing attackers to overflow the stack buffer. A remote attacker with administrator privileges can exploit this vulnerability to execute arbitrary system commands, disrupt system operations, or terminate services on the affected device.

Critical Impact

Authenticated attackers with administrator access can achieve remote code execution on ASUS RT-AC86U routers, potentially gaining full control of the network device and using it as a pivot point for further attacks on the internal network.

Affected Products

• ASUS RT-AC86U Firmware version 3.0.0.4.386.51255
• ASUS RT-AC86U Hardware

Discovery Timeline

• 2023-06-02 - CVE-2023-28703 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-28703

Vulnerability Analysis

This vulnerability is classified as CWE-121 (Stack-based Buffer Overflow), a critical memory corruption flaw that occurs when user-supplied data exceeds the allocated stack buffer size. In the context of the ASUS RT-AC86U router, the vulnerable CGI function processes network packet headers without adequately validating their length before copying data into a fixed-size stack buffer.

The attack requires network accessibility and administrator-level authentication to the device's web management interface. Once authenticated, an attacker can craft malicious requests with oversized packet header values that overflow the stack buffer, potentially overwriting critical memory structures including the return address. This allows the attacker to redirect program execution to arbitrary code, effectively achieving remote code execution with the privileges of the web server process running on the router.

The impact encompasses complete compromise of confidentiality, integrity, and availability of the affected device. Successful exploitation grants the attacker the ability to execute arbitrary system commands, which could be leveraged to install persistent backdoors, modify router configurations, intercept network traffic, or render the device inoperable.

Root Cause

The root cause of CVE-2023-28703 is insufficient input validation in the CGI function responsible for processing network packet headers. The function allocates a fixed-size buffer on the stack to store header data but fails to verify that the incoming data length does not exceed the buffer's capacity before performing the copy operation. This classic buffer overflow pattern allows attackers to write beyond the intended buffer boundaries, corrupting adjacent stack memory including saved registers and return addresses.

Attack Vector

The attack is executed remotely over the network against the router's web management interface. The attacker must first authenticate as an administrator to access the vulnerable CGI endpoint. Once authenticated, the attacker sends a specially crafted HTTP request containing an oversized network packet header value to the vulnerable CGI function.

The oversized header data overflows the stack buffer, overwriting the function's return address with a value controlled by the attacker. When the function attempts to return, execution is redirected to attacker-controlled code or ROP gadgets, enabling arbitrary command execution on the underlying system. The attacker can then execute system commands to install malware, exfiltrate configuration data, modify firewall rules, or establish persistent access to the compromised device.

Detection Methods for CVE-2023-28703

Indicators of Compromise

• Unexpected administrative login attempts or sessions to the router's web management interface from unusual IP addresses
• Anomalous HTTP requests to CGI endpoints containing unusually long header values or malformed packet data
• Unexpected processes or services running on the router that were not present in the baseline configuration
• Router configuration changes made without administrator knowledge, particularly to DNS settings, firewall rules, or port forwarding

Detection Strategies

• Implement network traffic monitoring to detect oversized HTTP requests targeting the router's management interface
• Deploy intrusion detection systems (IDS) with signatures for buffer overflow attack patterns against embedded devices
• Monitor authentication logs for unusual administrator login patterns or multiple failed authentication attempts followed by successful access
• Compare router firmware checksums and configuration files against known-good baselines to detect unauthorized modifications

Monitoring Recommendations

• Enable comprehensive logging on the ASUS RT-AC86U and forward logs to a central SIEM for analysis
• Configure alerts for any administrative access from external IP addresses or outside of normal business hours
• Implement network segmentation to isolate router management interfaces from untrusted networks
• Regularly audit active sessions and running processes on network devices to identify anomalies

How to Mitigate CVE-2023-28703

Immediate Actions Required

• Update the ASUS RT-AC86U firmware to the latest available version from ASUS that addresses this vulnerability
• Restrict administrative access to the router's web interface to trusted IP addresses only using access control lists
• Disable remote management access if not required for operations
• Review and strengthen administrator account credentials, ensuring complex passwords are in use

Patch Information

ASUS has been notified of this vulnerability. Administrators should check the TW-CERT Security Advisory and the official ASUS support website for firmware updates that address CVE-2023-28703. It is critical to apply the latest firmware version that includes security patches for this vulnerability. Always verify firmware integrity before installation by checking the firmware hash against the value published by ASUS.

Workarounds

• Disable the web management interface entirely if it is not essential for device administration
• Use VLAN segmentation to isolate the router's management plane from general network traffic
• Implement firewall rules on upstream devices to block external access to the router's web management ports (typically TCP 80/443)
• Enable HTTPS-only access to the management interface and disable HTTP to add a layer of transport security
• Consider deploying a VPN for remote administrative access rather than exposing the management interface directly