ASUS warns of critical auth bypass flaw in routers using AiCloud

Stembolt

The vulnerability discovered in AiCloud impacts a broad range of models, with ASUS releasing fixes for multiple firmware branches, including 3.0.0.4_382 series, 3.0.0.4_386 series, 3.0.0.4_388 series, and 3.0.0.6_102 series.

egeezer

Stembolt
3.0.0.4_24338 shows as current level for my RT-AX86S. I have an update scheduled for later today.
3.0.0.4_51733 shows as current level for my meshed RT-AC68Us. No update is indicated at this time for them, maybe it’s either current or the update will come later or after my primary updates.

Edit- according to ASUS USA site, 51733 is the current level at this time for the RT-AC68U.

bennor

Asus router’s AiCloud feature has had prior vulnerability issues, several of them. Asus Product Security Advisory had a notice posted on 01/02/2025 about an ASUS Router AiCloud vulnerability. That January notice involved two CVE’s (CVE-2024-12912 and CVE-2024-13062).

https://www.asus.com/content/asus-product-security-advisory/

egeezer

bennor
Update from https://www.asus.com/content/asus-product-security-advisory/

05/09/2025 Security Update for ASUS DriverHub ∇

The latest update contains fixes for the CVE-2025-3462, CVE-2025-3463

It’s a fix for the driver hub feature. The AI cloud firmware was released (I think) on 18 April.