Multiple ASUS Routers Impacted by New Security Vulnerability UPDATED

Customers of ASUS’ popular WiFi and broadband routers have been advised to ensure that they’re on the latest firmware (software update) after security researchers at GreyNoise published a new vulnerability, which has already allowed attackers to gain “unauthorized, persistent access” to thousands of devices exposed to the public internet.

The situation, which reminds us of a similar issue with DrayTek‘s routers that occurred earlier this year (here and here), sees attackers exploiting CVE-2023-39780 (severity score of 8.8 out of 10) – a command injection flaw – to execute system commands. But it’s a bit more complex than that, as some of the related exploits have yet to be given a designation.

Initial access to an affected router is gained via brute-force logins (i.e. trying masses of different combinations of logins/passwords) and two previously undisclosed authentication bypass vulnerabilities (neither have been assigned CVEs, yet). Once authentication has been bypassed, that’s when the attackers harness CVE-2023-39780 in order to take over your router.

GreyNoise Statement

The tactics used in this campaign — stealthy initial access, use of built-in system features for persistence, and careful avoidance of detection — are consistent with those seen in advanced, long-term operations, including activity associated with advanced persistent threat (APT) actors and operational relay box (ORB) networks. While GreyNoise has made no attribution, the level of tradecraft suggests a well-resourced and highly capable adversary.

‍The attacker’s access survives both reboots and firmware updates, giving them durable control over affected devices. The attacker maintains long-term access without dropping malware or leaving obvious traces by chaining authentication bypasses, exploiting a known vulnerability, and abusing legitimate configuration features.

As of 27th May 2025, nearly 9,000 ASUS routers are said to have been confirmed as compromised, based on scans from Censys, and the number of affected hosts is growing. The good news is that ASUS recently released new firmware for their routers to protect against the problem.

However, the bad news is that the attacker’s SSH configuration changes are NOT removed by firmware upgrades. Put another way, if a router was compromised before updating, the backdoor will still be present unless SSH access is explicitly reviewed and removed.

The research team thus recommends that owners of affected devices block the attacker(s) IP addresses (101.99.91.151, 101.99.94.173, 79.141.163.179 and 111.90.146.237) and then perform a full factory reset, then reconfigure manually. Credits to Thinkbroadband for spotting this one.

UPDATE 3rd June 2025 @ 11:21am

We’ve had a statement from ASUS on this issue, which we’ll post in full.

ASUS Statement

In response to recent media reports regarding attempts to exploit vulnerabilities in ASUS routers, ASUS would like to communicate that these vulnerabilities can be fixed. While some have noted that a firmware update alone may not completely address the issue, ASUS would like to emphasize the following recommendations — including updating to the latest firmware, performing a factory reset, and setting strong administrator passwords — to effectively restore and maintain device security.

The steps outlined below are not only essential for mitigating potential risks but also critical for reinforcing long-term protection and responsible device management in today’s evolving cybersecurity environment. 

Firmware updates and strong passwords can effectively prevent future risks

These media reports involve security vulnerability (CVE-2023-39780), which was disclosed in 2023. Devices that have been updated with the latest firmware and secured with a strong administrator password can prevent future exploitation of this vulnerability and block similar attack methods.  

Users are recommended to use a password at least 10 characters long, and include uppercase and lowercase letters, numbers, and symbols. In addition, ASUS recommends keeping device firmware up to date to ensure ongoing protection.

Devices that may have been affected can be fully restored

If the device was previously using outdated firmware along with a weak password, and users suspect it may have been compromised, please follow the steps below to secure the device:

1. Update the firmware to the latest version
2. Perform a factory reset to clear any unauthorized or abnormal settings
3. Set a strong administrator password as described above

These steps will ensure that the device is fully secured and no residual risk remain.

End-of-Life (EOL) devices can still be safely used

For EOL devices that no longer receive firmware updates, the following best practices are recommended:

1. Install the latest available firmware version for the device
2. Use a strong administrator password
3. Disable all remote access features such as SSH, DDNS, AiCloud, or Web Access from WAN

Completing the above steps will effectively prevent the exploitation methods described in recent reports.

Optional self-checks for suspicious activity

Users may perform the following checks to determine if their device shows signs of unauthorized access:

1. Confirm that the SSH (especially TCP port 53282) is not exposed to the internet
2. Check the System Log for repeated login failures or unfamiliar SSH keys
3. If anything appears suspicious, follow the above recommendations to thoroughly remove any potential threats.

ASUS remains fully committed to ensuring the security of its users. Firmware update notifications and security recommendations have been issued for supported models. For further assistance, please contact the ASUS Customer Service team.

Thank you for your continued trust and support.