A critical vulnerability affecting Asus routers running firmware version 3.0.0.6_102 allows specially crafted VPN configuration files to execute arbitrary commands. The flaw, rated 9.4 out of 10 on the CVSS 4.0 scale, also enables a logged‑in attacker to enable Telnet with root privileges. Asus has issued a security update that addresses both issues and urges users to avoid importing untrusted VPN profiles until the patch is applied.
The problem stems from how the router’s VPN client parses configuration files. Attackers can embed malicious directives that the router interprets as system commands, granting them full control over the device. In addition, a separate bug lets an attacker who has already logged into the router’s web interface toggle Telnet on, bypassing the usual security checks and opening a root‑level backdoor. Researchers discovered the chain of exploits during routine security testing and reported it to Asus, prompting the company to release firmware 3.0.0.6_102 with fixes for both weaknesses.
When a user imports a VPN profile, the router reads the file line by line, converting settings into internal variables. The flaw lies in insufficient validation of certain fields, allowing command injection. By inserting a line such as `exec /bin/sh`, an attacker can cause the router to run arbitrary shell commands. This can lead to credential theft, network sniffing, or the deployment of additional malware. The issue is not limited to a single model; any Asus router using the vulnerable firmware is at risk. Asus advises customers to refrain from adding VPN files from unknown sources and to apply the latest firmware immediately.
Yes. The second vulnerability is triggered after an attacker gains access to the router’s administrative interface, often through weak passwords or phishing. Once inside, the attacker can enable Telnet, which runs with root privileges by default. This effectively bypasses the router’s built‑in firewall and allows unrestricted command execution. The combined effect of both bugs creates a potent attack vector: an adversary could first compromise the web UI, then use the Telnet toggle to cement control, and finally leverage malicious VPN files to maintain persistence.
The fallout from these flaws could be severe for home and small‑business networks that rely on Asus routers for internet connectivity and VPN services. Compromised devices can become launch points for broader attacks, intercept sensitive traffic, or be enlisted in botnets. Asus’s prompt patch demonstrates responsible disclosure, but the incident underscores the importance of regular firmware updates and cautious handling of configuration files.
What steps should users take right now? Install the Asus firmware update 3.0.0.6_102 as soon as it becomes available, change default passwords, and avoid importing VPN configurations from unverified sources.
Will older Asus routers be affected? Any router running the vulnerable firmware version is at risk, regardless of model. Check the router’s firmware version in the admin panel and update if needed.
Is the Telnet backdoor still usable after the patch? The update disables the ability to enable Telnet via the web interface without proper authentication, effectively closing that attack path.