ASUS Router? - You may need an update, like NOW

[jmhmcse]

There currently seems to be an all out attack happening targeting ASUS routers. If you allow WAN access to your router, or any open ports, you should read through the following thread from SNBForums.

News - Trend Micro: Cyclops Blink Sets Sights on Asus Routers

This report discusses the technical capabilities of this Cyclops Blink malware variant that targets ASUS routers and includes a list of more than 150 current and historical command-and-control (C&C) servers of the Cyclops Blink botnet...

www.snbforums.com

A firmware upgrade is advisable if you are not already on stock version 3.0.0.4.386.xxxx (or higher), or 386.5 when using Merlin.

 

[Mike A.]

Mine was above .386... and it still prompted me today to do a firmware update.

Current Version : 3.0.0.4.386_43137-gc42c548
Manual firmware update : Upload
The latest version : 3.0.0.4.386_46065-ge51f2dc

 

[VorlonFrog]

Nope, NEVER allow WAN access to your router. Just don't.

 

[iwanttosee]

ASUS Product Security Advisory | ASUS Global

03/17/2022 Security Advisory for Cyclops Blink ∇

ASUS is investigating and working for a remediation for Cyclops Blink and will continue to post software update.
To help owners of these routers take necessary precautions, we compiled a security checklist:
(1) Reset the device to factory default: Login into the web GUI(

http://router.asus.com

) , go to Administration → Restore/Save/Upload Setting, click the “Initialize all the setting and clear all the data log”, and then click Restore button”
(2) Update all devices to the latest firmware.
(3) Ensure default admin password had been changed to a more secure one.
(4) Disable Remote Management (disabled by default, can only be enabled via Advanced Settings).
Affected products
GT-AC5300 firmware under 3.0.0.4.386.xxxx
GT-AC2900 firmware under 3.0.0.4.386.xxxx
RT-AC5300 firmware under 3.0.0.4.386.xxxx
RT-AC88U firmware under 3.0.0.4.386.xxxx
RT-AC3100 firmware under 3.0.0.4.386.xxxx
RT-AC86U firmware under 3.0.0.4.386.xxxx
RT-AC68U, AC68R, AC68W, AC68P firmware under 3.0.0.4.386.xxxx
RT-AC66U_B1 firmware under 3.0.0.4.386.xxxx
RT-AC3200 firmware under 3.0.0.4.386.xxxx
RT-AC2900 firmware under 3.0.0.4.386.xxxx
RT-AC1900P, RT-AC1900P firmware under 3.0.0.4.386.xxxx
RT-AC87U (EOL)
RT-AC66U (EOL)
RT-AC56U (EOL)
Please note that if you choose not to install this new firmware version then, to avoid any potential unwanted intrusion, we strongly recommend that you disable remote access from WAN and reset your router to its default settings.
If you have already installed the latest firmware version, please disregard this notice.
Should you have any question or concerns, please contact ASUS via our Security Advisory reporting system:
https://www.asus.com/securityadvisory

For further help with router setup and an introduction to network security, please visit
[Wireless] How to update the firmware of your router to the latest version ? (ASUSWRT) | Official Support | ASUS Global
[Wireless] How to make my router more secure? | Official Support | ASUS Global

 

[shannondalebreaux]

Nope, NEVER allow WAN access to your router. Just don't.

I just recently figured out how to used openVPN on my Asus router but without WAN access I can't view my cameras is there another way to do this with WAN access off while using openVPN?

 

[iwanttosee]

I just recently figured out how to used openVPN on my Asus router but without WAN access I can't view my cameras is there another way to do this with WAN access off while using openVPN?

No. You need a to open a 1194 UDP port so OpenVPN can use it.

 

[iwanttosee]

My RT AX-92U (aka AX6100) is at v3.0.0.4.386.46061 (2022/01/21) with no other updates.

So not affected by "Cyclops Blink" ?

Don't think your router is affected.