GreyNoise mentioned its in-house AI instrument, SIFT, flagged suspicious visitors geared toward disabling and exploiting a TrendMicro-powered security function, AiProtection, enabled by default on Asus routers.
Trojanizing the security internet
Asus’ AiProtection, developed with TrendMicro, is a built-in, enterprise-grade security suite for its routers, providing real-time risk detection, malware blocking, and intrusion prevention utilizing cloud-based intelligence.
After gaining administrative entry on the routers, both by brute-forcing or exploiting recognized authentication bypass vulnerabilities of “login.cgi” — a web-based admin interface, the attackers exploit an authenticated command injection flaw (CVE-2023-39780) to create an empty file at /tmp/BWSQL_LOG.
Doing this prompts the BWDPI (Bidirectional Internet Data Packet Inspection) logging function, a element of Asus’ AiProtection suite geared toward inspecting incoming and outgoing visitors. With logging turned on, attackers can feed crafted (malicious) payloads into the router’s visitors, as BWDPI is just not meant to deal with arbitrary information.
On this explicit case, the attackers use this to allow SSH on a non-standard port and add their very own keys, making a stealthy backdoor. “As a result of this secret is added utilizing the official Asus options, this config change is endured throughout firmware upgrades,” GreyNoise researchers mentioned. “In the event you’ve been exploited beforehand, upgrading your firmware will NOT take away the SSH backdoor.”
Whereas GreyNoise didn’t specify a selected CVE used as an authentication bypass for preliminary entry, Asus lately acknowledged a important authentication bypass vulnerability, tracked as CVE-2025-2492, affecting routers with the AiCloud function enabled.
