CVE-2023-35087: ASUS RT-AC86U Firmware RCE Vulnerability

CVE-2023-35087 Overview

A critical format string vulnerability has been identified in ASUS RT-AX56U V2 and RT-AC86U wireless routers. This security flaw exists within the AiMesh system, specifically in the ccm_processREQ_CHANGED_CONFIG function when calling cm_processChangedConfigMsg. The vulnerability stems from a lack of proper validation for a specific value, allowing attackers to inject format specifiers that can manipulate program execution.

An unauthenticated remote attacker can exploit this vulnerability without any privilege requirements to achieve remote arbitrary code execution, perform arbitrary system operations, or cause service disruption on affected devices.

Critical Impact

Unauthenticated attackers can achieve remote code execution on vulnerable ASUS routers, potentially compromising home and enterprise network infrastructure without any user interaction required.

Affected Products

• ASUS RT-AX56U V2 firmware version 3.0.0.4.386_50460
• ASUS RT-AC86U firmware version 3.0.0.4_386_51529
• ASUS RT-AX56U V2 hardware
• ASUS RT-AC86U hardware

Discovery Timeline

• July 21, 2023 - CVE-2023-35087 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-35087

Vulnerability Analysis

This format string vulnerability (CWE-134) affects the AiMesh mesh networking functionality in ASUS routers. The AiMesh system enables multiple ASUS routers to work together as a unified mesh network, and the vulnerability lies within the configuration change message processing component.

When the ccm_processREQ_CHANGED_CONFIG function processes incoming configuration change requests, it calls cm_processChangedConfigMsg without adequately validating user-controlled input. This missing validation allows an attacker to inject format string specifiers (such as %s, %x, %n) into the data stream.

Format string vulnerabilities are particularly dangerous because they can be leveraged for multiple attack scenarios: reading from arbitrary memory locations (information disclosure), writing to arbitrary memory locations (code execution), or causing application crashes (denial of service). In this case, the network-accessible nature of the vulnerability combined with the lack of authentication requirements makes it especially severe.

Root Cause

The root cause is improper input validation (CWE-134: Use of Externally-Controlled Format String) in the AiMesh configuration message handling code. The cm_processChangedConfigMsg function processes user-supplied data that is subsequently used as a format string argument without proper sanitization or validation. This allows attackers to supply malicious format specifiers that the underlying printf-family functions interpret as formatting commands rather than literal data.

Attack Vector

The attack can be executed remotely over the network without authentication. An attacker with network access to a vulnerable ASUS router can send specially crafted configuration change messages to the AiMesh service. These messages contain format string specifiers that, when processed by the vulnerable function, allow the attacker to:

1. Read sensitive data from the router's memory stack
2. Write arbitrary values to memory locations using the %n format specifier
3. Gain control of program execution flow to achieve remote code execution
4. Crash the service to cause denial of service conditions

The exploitation does not require user interaction, making this vulnerability highly exploitable in real-world scenarios. For detailed technical information, refer to the TWCert Security Advisory.

Detection Methods for CVE-2023-35087

Indicators of Compromise

• Unusual network traffic patterns targeting AiMesh service ports on ASUS routers
• Unexpected crashes or restarts of router services, particularly the AiMesh configuration daemon
• Anomalous configuration change requests containing format string characters (%s, %x, %n, %p)
• Evidence of unauthorized access or configuration modifications on affected routers

Detection Strategies

• Monitor network traffic for malformed or suspicious AiMesh protocol messages containing format string specifiers
• Implement network intrusion detection rules to identify exploitation attempts targeting configuration message handling
• Review router logs for service crashes or unexpected behavior in AiMesh-related processes
• Deploy network segmentation to isolate IoT/router management interfaces from untrusted networks

Monitoring Recommendations

• Enable comprehensive logging on affected ASUS routers and forward logs to a centralized SIEM solution
• Monitor for unexpected outbound connections from router devices that may indicate successful compromise
• Regularly audit firmware versions across all ASUS networking equipment to identify vulnerable devices
• Implement alerting for any configuration changes on router devices that were not authorized through change management

How to Mitigate CVE-2023-35087

Immediate Actions Required

• Update affected ASUS RT-AX56U V2 and RT-AC86U routers to the latest available firmware immediately
• Restrict network access to router management interfaces to trusted networks only
• Disable the AiMesh feature if not actively required until patching is complete
• Audit network infrastructure for any signs of compromise on affected devices

Patch Information

ASUS has addressed this vulnerability in updated firmware releases. Administrators should check the official ASUS support website for the latest firmware versions for RT-AX56U V2 and RT-AC86U models. The vulnerable firmware versions are:

• RT-AX56U V2: 3.0.0.4.386_50460
• RT-AC86U: 3.0.0.4_386_51529

For additional details, consult the TWCert Security Advisory.

Workarounds

• Disable the AiMesh functionality if not required for network operations
• Implement firewall rules to block untrusted access to router management interfaces and AiMesh services
• Place routers behind a network firewall that can filter malicious traffic before it reaches the device
• Use network segmentation to isolate router management traffic from general network access

# Network segmentation example - block external access to router management
# On upstream firewall, restrict access to router management IP
iptables -A FORWARD -d <router_management_ip> -j DROP
iptables -A FORWARD -s <trusted_admin_network> -d <router_management_ip> -j ACCEPT