{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ot-mobiletm-ac19003.0.0.4.376_3169/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:asus:asuswrt:*:*:*:*:*:*:*:*","cpe:2.3:o:t-mobile:tm-ac1900:3.0.0.4.376_3169:*:*:*:*:*:*:*","cpe:2.3:o:asus:wrt_firmware:3.0.0.4.376.2524-g0012f52:*:*:*:*:*:*:*","cpe:2.3:o:asus:wrt_firmware:3.0.0.4.376_1071:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2014-9583"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ASUSWRT (various versions)","T-mobile tm-ac1900 (3.0.0.4.376_3169)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","rce","iot","cve-2014-9583"],"_cs_type":"advisory","_cs_vendors":["ASUS","T-Mobile"],"content_html":"\u003cp\u003eCVE-2014-9583 is a pre-authentication remote code execution vulnerability affecting the ASUSWRT \u003ccode\u003einfosvr\u003c/code\u003e daemon. The daemon listens on UDP port 9999 and processes \u003ccode\u003eIBOX_COMM_PKT_HDR_EX\u003c/code\u003e packets. Due to insufficient authentication checks, the daemon fails to validate the MAC address or password field provided in the packet header. An attacker can supply a crafted packet with \u003ccode\u003eOpCode 0x33\u003c/code\u003e (\u003ccode\u003eNET_CMD_ID_MANU_CMD\u003c/code\u003e) to trigger command injection, resulting in execution as the root user.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full control of the affected router, including root command execution. The source notes that this vulnerability has been historically leveraged by IoT botnets to compromise ASUS and T-Mobile networking equipment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately block all ingress UDP traffic to port 9999 on WAN-facing interfaces.\u003c/li\u003e\n\u003cli\u003eUpdate ASUSWRT firmware to the latest version, if available; for EOL models, replace the firmware with a secure, supported alternative.\u003c/li\u003e\n\u003cli\u003eDisable UPnP and remote management features if they are not strictly required for network operations.\u003c/li\u003e\n\u003cli\u003eReset administrative passwords to mitigate secondary impact if the device was previously compromised.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T00:04:26Z","date_published":"2026-10-31T00:04:26Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2014-9583-asuswrt/","summary":"An authentication bypass vulnerability in the ASUSWRT infosvr daemon allows unauthenticated remote attackers to execute arbitrary system commands with root privileges via UDP port 9999.","title":"ASUSWRT infosvr: pre-authentication remote code execution (CVE-2014-9583)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2014-9583-asuswrt/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:o:t-Mobile:tm-Ac1900:3.0.0.4.376_3169:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}