Last week, we saw a
worm introduced to a series of Linksys Router models. Belkin scrambled to help us alert you and to provide a temporary fix, along with providing information about a proposed firmware update that is forthcoming.
But, a new manufacturer router has been identified as being vulnerable and already exploited.
Ten models of the ASUS wireless routers are vulnerable to unauthorized access if the AiCloud feature is enabled. One of the features of AiCloud is that it allows owners to hook a storage device to the router and then be able to connect to locally stored data remotely. Apparently, the feature also allows anonymous access to the built-in FTP server and stores user names and password in plain text.
The vulnerable ASUS router models:
• RT-AC66R Dual-Band Wireless-AC1750 Gigabit Router
• RT-AC66U Dual-Band Wireless-AC1750 Gigabit Router
• RT-N66R Dual-Band Wireless-N900 Gigabit Router with 4-Port Ethernet Switch
• RT-N66U Dual-Band Wireless-N900 Gigabit Router
• RT-AC56U Dual-Band Wireless-AC1200 Gigabit Router
• RT-N56R Dual-Band Wireless-AC1200 Gigabit Router
• RT-N56U Dual-Band Wireless-AC1200 Gigabit Router
• RT-N14U Wireless-N300 Cloud Router
• RT-N16 Wireless-N300 Gigabit Router
• RT-N16R Wireless-N300 Gigabit Router
A researcher on Bugtraq has offered a couple workarounds while ASUS works on a fix:
Full Disclosure ASUS Wireless Routers Ten Models - Multiple Vulnerabilities on AiCloud enabled unitssource:windowsitpro
