ASUS patches critical router flaw that allows remote attacks – Source: www.csoonline.com

ASUS is urging customers with AiCloud enabled on their ASUS routers to immediately upgrade firmware against a critical vulnerability that allows unauthorized activities by remote actors.

Tracked as CVE-2025-2492, the vulnerability is an authentication bypass issue receiving a critical severity rating of CVSS 9.2 out of 10.

“An improper authentication control vulnerability exists in certain ASUS router firmware series,” the gaming and networking hardware giant said in an advisory. “This vulnerability can be triggered by a crafted request, potentially leading to unauthorized execution of functions.”

ASUS AiCloud is a cloud-based service enabled by default in many ASUS routers that allows certain remote functions, including accessing files remotely from any device with internet, syncing files between routers and connected storage like a USB drive, connecting to the home network remotely, and syncing files with connected cloud services like Dropbox.

Problem was fixed in four firmware series 

ASUS confirmed the vulnerability affecting a wide line of devices, issuing patches for multiple firmware series, including 3.0.0.4_382, 3.0.0.4_386, 3.0.0.4_388, and 3.0.0.6_102.

A possible workaround for customers unable to apply patches could be to ensure stronger login and WiFi passwords, the company added.

Additionally, ASUS recommended disabling AiCloud and any service that can be accessed from the internet, such as remote access from WAN, port forwarding, DDNS, VPN server, DMZ port triggering, and FTP, as an alternative to applying fixes.

“Use different passwords for your wireless network and router-administration page,” Asus said. “Use passwords that have at least 10 characters, with a mix of capital letters, numbers, and symbols. Do not use the same password for more than one device or service. Do not use passwords with consecutive numbers or letters.”

Router flaw could compromise network

While ASUS did not reveal if the flaw was exploited in the wild, a successful abuse of the issue could allow attackers to gain unauthorized access and execute critical router functions, potentially leading to a network compromise and data exfiltration.

ASUS routers and the underlying firmware have had a handful of high-to-critical severity mishaps in the recent past, with a couple of them abused in the wild. Most critical of these bugs include a remote authentication bypass flaw (CVE-2024-3080) allowing full control over affected routers, and an arbitrary firmware upload issue (CVE-2024-3912) allowing arbitrary command execution.

One of the most dramatic moments in ASUS’ security history came in 2019, when attackers managed to sneak a backdoored version of an official ASUS application onto the company’s own update servers. The malicious software was picked up by over a million unsuspecting users, turning the incident into a massive supply chain compromise.