Asus routers have a serious vulnerability; users need to update their firmware.

To set it up, users can import the configuration file provided by the VPN service provider into the router. However, a file created with special content can cause the device to misinterpret the data inside, leading to the execution of unintended commands on the router.

An attacker who has gained login access to the router's administration interface could exploit this vulnerability. Another scenario is that the user unknowingly imports a malicious VPN configuration file. Therefore, Asus recommends using only VPN configuration files from trusted sources.

This vulnerability does not mean that using regular VPN applications on a computer or phone will put the Asus router at risk. The problem lies in the feature of importing VPN configuration files directly into the router and affects firmware version 3.0.0.6_102.

This isn't the first time the VPN configuration import function on Asus routers has had security issues. In 2024, another vulnerability was discovered at the same file import point on the device's administration interface.

The second vulnerability can be exploited once an attacker has logged into the router. This weakness allows for the activation of Telnet, a feature used for remote access and control of devices. From there, the attacker can gain the highest administrative privileges, deeply interfere with the router's operation, and potentially affect other devices on the same network.