One Million ASUS Routers Under Control: Exploiting ASUS DDNS to MITM Admin Credentials

...Notably, ASUS routers - of which around one million are exposed to the internet via port 8443/tcp (Shodan query: port:8443 os:"ASUSWRT") - display a distinct susceptibility. Investigation reveals the user-friendly "ASUS Router App" inadvertently alters router settings, making them accessible online.

Our research discovered that these routers, whether intended or not, configured via ASUS's DDNS, are susceptible to a man-in-the-middle (MITM) attack, which we identified, enabling the theft of admin credentials...

By: Masaki Kubo , Yoshiki Mori , Kanta Okugawa …

admin app asus asus routers control credentials display exploiting exposed internet investigation making mitm port query research router routers settings shodan tcp under