Asus router: Security flaw allows unauthorized execution of functions

The security of Asus routers is threatened by a vulnerability in Asus' AiCloud service. Attackers can use it to execute unauthorized functions, the manufacturer warns.

In the CVE entry for the vulnerability, Asus explains that there is insufficient authentication control in the AiCloud. This could be abused by manipulated requests to execute functions without authorization (CVE-2025-2492, CVSS 9.2, risk "critical").

Anywhere access to data

As Asus does not provide any details about the vulnerability, the information does not provide any insight into how attackers can abuse it. However, the Asus AiCloud software provides functions for accessing data in the home LAN via an app, for example, i.e. gaining access to your data from anywhere. In the security notice, Asus only writes that the developers have released updated firmware for the 3.0.0.4_382, 3.0.0.4_386, 3.0.0.4_388 and 3.0.0.6_102 series. This is intended to fix the vulnerability.

Asus recommends installing the new firmware, which is available on the Asus support website if you search for the model number. As a further security tip, the manufacturer states that the WLAN and the router administration website should have different passwords. These should also be at least ten characters long and contain a mix of upper and lower case letters, numbers and special characters. Asus explicitly warns against passwords with simple sequences of numbers or letters, such as those in alphabetical order or those that result from pressing the keys next to each other on the keyboard.

Asus advises those who are unable to perform the update or who cannot receive a firmware update due to the end-of-life of their device to ensure that router and WLAN passwords are strong. In addition, those affected should deactivate AiCloud and disable any service that can be accessed from the Internet, such as remote access from the WAN, port forwarding, DDNS, the VPN server, the DMZ, port triggering and FTP.

Security vulnerabilities in Asus' AiCloud service became known at the beginning of January. This could have allowed attackers to completely compromise devices. The manufacturer also distributed firmware updates there to solve the problems.

(dmk)