External risk intelligence

Asus Router Buffer Overflow Vulnerability in blocking_request.cgi

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2021-45756

This vulnerability affects Asus wireless routers. These devices are designed to serve as internet edge gateways, and the vulnerable component, a CGI script, is typically accessible via the router's web-based management interface, which is commonly exposed to the internet in many consumer and small-office deployments.

Buffer Overflow

Asus Rt Ac68u Firmware

before 3.0.0.4.385.20633before 3.0.0.4.384.82072

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability found in certain Asus router models that could allow an unauthenticated attacker to remotely execute commands. The issue stems from a buffer overflow flaw within a specific router function, potentially impacting the security and integrity of network traffic passing through the affected devices. The main concern at this stage is confirming relevance and exposure within our environment.

Flaw in router software allows remote command execution.
Critical issue impacts network edge devices.
Confirm affected routers and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach a vulnerable component on an Asus router by sending specially crafted network requests. This could potentially allow them to remotely execute code on the device.

Network access required.
Exploited via blocking_request.cgi.
Remote code execution possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to cause a denial-of-service condition or potentially execute arbitrary code on affected Asus routers when they are accessible from the network. This could disrupt internet connectivity for users connected to the router.

Router availability and configuration data.
Network access to vulnerable CGI script.
Disruption of network services.

Operational Fix

Recommended remediation, mitigation, and detection steps

The ownership for this vulnerability likely falls to the network infrastructure or platform teams managing the Asus routers, as these devices often act as internet edge gateways. The first practical step is to identify all deployed Asus routers, confirm their internet exposure and business criticality, and then locate the accountable owner for remediation planning.

Network infrastructure and platform teams own this.
Verify router internet exposure and criticality.
Plan vendor-coordinated updates or replacements.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Asus RT-AC68U and RT-AC5300?

These are high-performance wireless routers often used in homes and small offices to manage internet connectivity. They act as network gateways, directing traffic between the local devices and the wider internet. The firmware running on these routers handles critical management tasks, including the web-based interface used to configure router security, settings, and network access controls.

How does this buffer overflow vulnerability work?

This vulnerability is classified as CWE-120, which involves a buffer overflow. In plain terms, the software fails to properly check the size of incoming data before copying it into a reserved memory area. By sending an oversized request to the 'blocking_request.cgi' script, an attacker can overwrite adjacent memory. This allows the attacker to corrupt the router's normal operations, potentially leading to unauthorized command execution or a system crash.

Do I need to do anything to trigger this CVE-2021-45756 bug?

You do not need to take any action; rather, the vulnerability exists if an attacker sends a specifically crafted network request to the vulnerable CGI script. Normal web traffic or routine router management will not trigger the overflow. The flaw is only activated when the router processes malicious input designed to overwhelm the buffer, meaning the risk is tied to the router's exposure to potentially untrusted network traffic.

Why should I care about CVE-2021-45756?

According to Halo Surface Signal, this vulnerability is particularly relevant because it affects internet edge devices. Since the vulnerable CGI script is part of the router's management interface, any device that has this interface exposed to the internet is at higher risk. Even if your router is for internal use, an attacker who gains access to your local network could reach this interface to execute code or disrupt your internet service.

How do I respond to this Asus router vulnerability?

Start by identifying all Asus RT-AC68U and RT-AC5300 units in your environment to determine if they are running the affected firmware versions. Verify whether the web management interface is reachable from the internet or restricted to local access. Once identified, coordinate with your network infrastructure team to plan and apply the necessary vendor firmware updates to secure the device and mitigate the risk.

References

asus.com/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.