CVE-2014-9583: Auth bypass on ASUS routers, RCE

CVE-2014-9583 describes an authentication bypass in ASUS WRT firmware used on routers such as RT-AC66U and RT-N66U. The flaw resides in the infosvr service listening on UDP port 9999: the system does not properly validate the MAC address of incoming requests, allowing unauthenticated remote attackers to send arbitrary commands via NET_CMD_ID_MANU_CMD packets and achieve code execution on the device. These routers are common in both enterprise and home environments, making the potential impact widespread.

The CVSS score is 10.0, the maximum possible, reflecting the absence of access restrictions (no authentication required) and full system compromise. The vulnerability was publicly documented on January 8, 2015 on NVD, meaning it has been known for over a decade; however, recent signals on public platforms (GitHub repositories dated October 30, 2026) suggest renewed interest and possible availability of proof-of-concept code. Many routers running this firmware may not have been patched in the past ten years.

For organizations: inventory ASUS routers and verify firmware versions via the admin interface or SSH. Contact ASUS for patches available for versions 3.0.0.4.376_1071 and 3.0.0.376.2524-g0013f52. If updates are not immediately available, temporarily isolate these routers from untrusted networks or those handling sensitive data. Implement firewall rules to restrict access to UDP port 9999 to trusted internal sources only. Actively monitor traffic to this port to detect exploitation attempts.