Recently ASUS patched two issues I discovered in the RT-AC1900P router firmware update functionality. These vulnerabilities could allow for complete compromise of the router and all traffic that traverses it.
Finding 1: Update Accepts Forged Server Certificates (CVE-2020-15498)
The first vulnerability was about accepting untrusted (forged) certificates by the wget program used by the router to fetch the updates from ASUS servers. If you happen to have an ASUS RT-AC1900P using old firmware, you can log in via SSH and grep through the filesystem for a string:
This will yield some shell scripts that perform downloads from the ASUS update servers. A malicious attacker could exploit this lack of certificate checking to force the install of malicious files. While the attacker would have to be adjacent network wise to the vulnerable router to perform the man in the middle attack (MITM), a successful attack could result in a full compromise of the router allowing for complete access to all traffic going through it. The latest firmware does not use this wget option anymore, so the MITM attack is no longer possible.
Finding 2: XSS in Release Notes Dialog Window (CVE-2020-15499)
ASUS fixed this in the latest firmware so that the release notes page no longer renders arbitrary contents verbatim.
Since routers like this one typically define the full perimeter of a network, attacks targeting them can potentially affect all traffic in and out of your network. ASUS patched this issue in firmware version 18.104.22.168.385_20253, so please patch as soon as you can.
Trustwave Advisory TWSL2020-004 : https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=27440