Last week, we saw a worm introduced to a series of Linksys Router models. Belkin scrambled to help us alert you and to provide a temporary fix, along with providing information about a proposed firmware update that is forthcoming.

But, a new manufacturer router has been identified as being vulnerable and already exploited.

Ten models of the ASUS wireless routers are vulnerable to unauthorized access if the AiCloud feature is enabled. One of the features of AiCloud is that it allows owners to hook a storage device to the router and then be able to connect to locally stored data remotely. Apparently, the feature also allows anonymous access to the built-in FTP server and stores user names and password in plain text.

The vulnerable ASUS router models:

  • RT-AC66R   Dual-Band Wireless-AC1750 Gigabit Router
  • RT-AC66U   Dual-Band Wireless-AC1750 Gigabit Router
  • RT-N66R     Dual-Band Wireless-N900 Gigabit Router with 4-Port Ethernet Switch
  • RT-N66U     Dual-Band Wireless-N900 Gigabit Router
  • RT-AC56U   Dual-Band Wireless-AC1200 Gigabit Router
  • RT-N56R     Dual-Band Wireless-AC1200 Gigabit Router
  • RT-N56U     Dual-Band Wireless-AC1200 Gigabit Router
  • RT-N14U     Wireless-N300 Cloud Router
  • RT-N16       Wireless-N300 Gigabit Router
  • RT-N16R     Wireless-N300 Gigabit Router

A researcher on Bugtraq has offered a couple workarounds while ASUS works on a fix:  Full Disclosure ASUS Wireless Routers Ten Models - Multiple Vulnerabilities on AiCloud enabled units