Skip to content
Threat Feed
Subscribe
critical advisory

ASUSWRT infosvr: pre-authentication remote code execution (CVE-2014-9583)

An authentication bypass vulnerability in the ASUSWRT infosvr daemon allows unauthenticated remote attackers to execute arbitrary system commands with root privileges via UDP port 9999.

CVE search metadata

CVE search record: CVE-2014-9583. EPSS: 80.23%. KEV: no. Product: ASUSWRT (various versions), T-mobile tm-ac1900 (3.0.0.4.376_3169). Brief: ASUSWRT infosvr: pre-authentication remote code execution (CVE-2014-9583). Brief link: https://feed.craftedsignal.io/briefs/2026-10-cve-2014-9583-asuswrt/

Triage facts

Revision 1
Applicability
ASUSWRT (various versions), T-mobile tm-ac1900 (3.0.0.4.376_3169)
Evidence
Unknown
Severity
Critical
Action
Elevated
Sources
2 public sources
Freshness
Revision 1Oct 31, 00:04 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B2Likely

CVE-2014-9583 is a pre-authentication remote code execution vulnerability affecting the ASUSWRT infosvr daemon. The daemon listens on UDP port 9999 and processes IBOX_COMM_PKT_HDR_EX packets. Due to insufficient authentication checks, the daemon fails to validate the MAC address or password field provided in the packet header. An attacker can supply a crafted packet with OpCode 0x33 (NET_CMD_ID_MANU_CMD) to trigger command injection, resulting in execution as the root user.

Impact

Successful exploitation allows for full control of the affected router, including root command execution. The source notes that this vulnerability has been historically leveraged by IoT botnets to compromise ASUS and T-Mobile networking equipment.

Recommendation

  • Immediately block all ingress UDP traffic to port 9999 on WAN-facing interfaces.
  • Update ASUSWRT firmware to the latest version, if available; for EOL models, replace the firmware with a secure, supported alternative.
  • Disable UPnP and remote management features if they are not strictly required for network operations.
  • Reset administrative passwords to mitigate secondary impact if the device was previously compromised.

Immediate actions

Block UDP port 9999 on all WAN edge firewalls.

IT Operations 24h

Threat Hunt

Inspect device logs for unauthorized processes spawned by infosvr or unusual files created in /tmp.

T1059 high medium confidence hunt now

Data: Syslog or EDR data from router devices

Mitigations

Firmware update to a version that disables or patches infosvr.

immediate IT Operations

CVE-2014-9583

Detection coverage 1

Detect ASUSWRT infosvr CVE-2014-9583 Exploitation

critical

Detects exploitation of CVE-2014-9583 by identifying crafted UDP packets sent to port 9999 containing the vulnerable OpCode sequence.

sigma tactics: execution, initial_access techniques: T1190 sources: network_connection, firewall

Detection queries are available on the platform. Get full rules →