Thousands of Asus routers are being hit with stealthy, persistent backdoors
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-39780 | Authenticated OS Command Injection in ASUS RT-AX55 Routers ASUS RT-AX55 routers contain an OS command injection vulnerability (CWE-78) that allows a remote, authenticated attacker to execute arbitrary operating-system commands on the device. The flaw is triggered when an authenticated session submits crafted input that the router passes to its underlying OS without proper sanitization, though the available data does not identify the specific vulnerable parameter or affected firmware versions. Successful exploitation yields arbitrary command execution at the router's privilege level, which an attacker could use to change device configuration, establish persistence, or pivot into the networks behind the router. Any deployed ASUS RT-AX55 router is affected per CISA's listing, with the greatest risk on units whose management interface is reachable remotely. CISA added the issue to the Known Exploited Vulnerabilities catalog on 2025-06-02 (noting it as represented by CVE-2023-41346), confirming exploitation in the wild; EPSS currently estimates a 33.9% probability of exploitation within 30 days (98th percentile), no public PoC is known, and ransomware use is unknown. Do: Update RT-AX55 firmware to the latest release from ASUS, checking the vendor's security advisory for CVE-2023-39780 and the related CVE-2023-41346, as the available data does not specify a fixed version. Until patched, restrict administrative access (disable WAN-side/remote management if not needed), enforce strong administrator credentials, and review device settings for signs of tampering. Federal agencies should apply vendor mitigations per BOD 22-01 timelines or discontinue use of affected RT-AX55 routers if mitigations are unavailable. | 8.8 | 40% | KEV PoC ×7 |
| largehundreds of thousands of units deployed worldwide, with tens of thousands to hundreds of thousands likely internet-exposed (estimate; no RT-AX55-specific… |
Full article256 words · extracted from arstechnica.com · click to collapse
GreyNoise said it detected the campaign in mid-March and held off reporting on it until after the company notified unnamed government agencies. That detail further suggests that the threat actor may have some connection to a nation-state.
The company researchers went on to say that the activity they observed was part of a larger campaign reported last week by fellow security company Sekoia. Researchers at Sekoia said that Internet scanning by network intelligence firm Censys suggested as many as 9,500 Asus routers may have been compromised by ViciousTrap, the name used to track the unknown threat actor.
The attackers are backdooring the devices by exploiting multiple vulnerabilities. One is CVE-2023-39780, a command-injection flaw that allows for the execution of system commands, which Asus patched in a recent firmware update, GreyNoise said. The remaining vulnerabilities have also been patched but, for unknown reasons, have not received CVE tracking designations.
The only way for router users to determine whether their devices are infected is by checking the SSH settings in the configuration panel. Infected routers will show that the device can be logged in to by SSH over port 53282 using a digital certificate with a truncated key of: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAo41nBoVFfj4HlVMGV+YPsxMDrMlbdDZ…
To remove the backdoor, infected users should remove the key and the port setting.
People can also determine if they’ve been targeted if system logs indicate that they have been accessed through the IP addresses 101.99.91[.]151, 101.99.94[.]173, 79.141.163[.]179, or 111.90.146[.]237. Users of any router brand should always ensure their devices receive security updates in a timely manner.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arstechnica.com/security/2025/05/thousands-of-asus-routers-are-being-hit-with-stealthy-persistent-backdoors/