Security Fixes

- Web management interface: Strengthened data handling for the connected device list and added stricter content checks when importing configuration profiles.
- Network speed test service: Added allowlist validation for service command parameters, so that only expected values are accepted.
- System protection service: Adjusted address parameter validation and event logging, strengthening access control between local services.
- Certificate import process: Adjusted file handling and password passing, with stricter parameter validation.
- Third-party account authorization: Narrowed the recipients of authorization data to better protect authorization information.
- Web management interface: Adjusted the output handling of feedback content.
- Notification service: Added identity verification for local connection sources and tightened the related file permission settings.
- Mobile device connection authorization: Added a device matching check to strengthen the access token issuance process.
- Device discovery service: Removed a non-essential internal function endpoint to strengthen overall access control.
- AiMesh: Adjusted data access protection during the node joining process, improving system stability while connections are being established.
- System temporary directory: Adjusted the default permissions applied at creation time to narrow local file access.
- Network diagnostic data query: Strengthened value range checks for time interval parameters.
- Network diagnostic data query: Added allowlist validation for query fields.
- Internal data query: Improved field matching logic and optimized the memory release process under error conditions.
- Time synchronization settings: Strengthened parameter validation for the server name.
- File upload handling: Fixed an issue where certain input formats could cause the web management service to become unresponsive.
- Wireless channel selection tool: Adjusted the handling of command parameters to prevent unintended command execution.
- Certificate upload: Added a pre-check of archive contents to prevent files from being written to unintended locations.
- System configuration file generation: Strengthened parameter content checks to prevent abnormal configuration values from affecting network service settings.
- VPN and account authentication services: Adjusted the handling of connection settings and account data, with stricter parameter validation.

We recommend updating to this version to maintain optimal protection.

Security Fixes
- Strengthened data handling in Networks configuration functions.
- Improved data validation in Networks rule list processing.
- Fixed a data-handling issue in the DNS query caching component.
- Strengthened verification when a software component downloads - external resources, improving connection security.
- Adjusted the information response mechanism of the device discovery service, strengthening protection of device information.
- Fixed a data-handling issue in a firmware component on a specific model.
- Improved data-display handling in a web function to enhance browsing security.
- Strengthened input data validation in a device-pairing web function.
- Improved data validation in the configuration file upload/sync function.
- Improved how the account service restart process is handled.
- Removed a non-essential internal function endpoint, strengthening overall access control.
- Adjusted the debug file access mechanism, strengthening protection of internal data.
- Strengthened data handling in the system logging function.

We recommend upgrading to this version to maintain optimal protection.

Bug Fixes and Enhancements
- Improved WiFi roaming behavior to reduce temporary disconnections in some scenarios.
- Improved roaming compatibility for certain client devices.
- Improved App Remote Connection stability in certain scenarios to prevent unexpected connection drops.
- Improved AiMesh onboarding reliability, addressing cases where the onboarding process could stall and fail to complete.
- Fixed an issue where the guest network client list might not display correctly in certain scenarios.
- Fixed an issue with Web history display.
- Fixed an issue where the app could not remove offline devices.
- Fixed an issue where specific IPv6 configuration flows could cause IPv6 connectivity problems on the main network.
- Fixed an issue where enabling System Diagnostics and staying on a specific page could cause repeated reboots.
- https://portal.expertwifi.net/ is now supported, by accessing portal, you won't need to download windows or mac utility to access sites remotely.

Security Fixes
- Enhanced input validation and protection to reduce the risk of command injection and SQL injection.
- Hardened environment variable handling.
- Hardened protections around specific logging/command composition flows to reduce potential injection risks.
- Patched a command injection risk in a specific network diagnostic function.
- Enhanced DNS name handling to address a potential memory issue that could occur in rare cases during name format conversion, improving system security and robustness.
- Improved safeguards for execution modules to reduce the risk of substitution during certain processes.

We recommend upgrading to this version to maintain best protection.

1. Optimized memory management mechanisms, improving system efficiency and stability.
2. Strengthened input validation and data processing workflows, further protecting your information security.
3. Improved web rendering engine, enhancing browsing experience and security.
4. Enhanced security of system command processing to guard against potential malicious operations.
5. Perfected JavaScript-related security mechanisms, offering a more secure web interaction environment.

Please unzip the firmware file, and then verify the checksum.
SHA256: 3942cc2e9340a7dd991ec052f0a758fce8eb40fd42fc492627e07902e9ec251e

Fixed DDNS related issue.

Please unzip the firmware file, and then verify the checksum.
SHA256: 18a30e19a9981b41d1dbd27f830a3b2428063a6df1d2664fa0386863001e24b8

Security
- Fixed command injection vulnerability.
- Fixed the ARP poisoning vulnerability. Thanks to the contribution of Xin'an Zhou.
- Fixed code execution in custom OVPN. Thanks to the contrubution of Jacob Baines.
- Fixed stack buffer overflow in lighttpd. Special thanks to Viktor Edstrom.
- Fixed CVE-2023-35720
- Fixed the XSS and Self-reflected HTML injection vulnerability. Thanks to the contrubution of Redfox Cyber Security.
- Fixed CVE-2024-1655 command injection vulnerability.

Feature:
- Icon display improvment on AiMesh page.
- Fixed stability issues.
- Fixed openvpn GUI issues.
- Fixed GUI issues on Dashboard.
- Fixed SDN canot be added properly

Please unzip the firmware file, and then verify the checksum.
SHA256: b15186e22edf17aae5bf3275723b3687923e5a58017ea159399654b4052b877d

New features and Enhancements:
-4G / 5G Auto Mobile Tethering allows you to connect your phone to the router’s USB port and use it as an internet source. Please refer to https://www.asus.com/support/FAQ/1050074/
-DDNS transfer allows you to transfer your ASUS DDNS hostname from your original router to the new one. Please refer to https://www.asus.com/support/FAQ/1048684/

Bug fixes and function modifications:
- Resolved Self-defined Network issues to prioritize devices for various business usages and network alternatives.
- Resolved AiMesh-related issues to provide stable backhaul connection.
- Resolved GUI issues to ensure that the user interface is even more user-friendly.

Optimizations:
- Multiple-language support has been optimized.
- System stability has been enhanced to provide unwavering reliability.

Please unzip the firmware file, and then verify the checksum.
SHA256: 99c77fc2bda3f62e7a0ad6f0c6695c7c986163479a02ba5eec3eacd0586d30c1

Initial firmware release

Please unzip the firmware file, and then verify the checksum.
SHA256: d7c4f222f3bcf7ededfc6f580865a17bbdf25daa4e3475f8a6517ea7da2775ca