Security:
Fixed Client DOM Stored XSS.
Fixed CVE-2022-46871.
Fixed httpd command injection vulnerabilities.
Fixed httpd DoS vulnerabilities.
Fixed httpd integer overflow vulnerability.
Fixed httpd Null Pointer Dereference vulnerabilities.
Fixed lighttpd command injection vulnerability.
Fixed not secure cookies when using https.
Fixed cfg server security issues.
Fixed Stored Cross Site Scripting.
Updated OpenSSL to version 1.1.1t for CVE vulnerabilities.
Fixed XSS attack via USB EXT3 foldername.
Fixed Stored Cross Site Scripting. Thanks to Howard McGreehan.
Fixed XSS attack via malformed hostname in DHCP request
Fixed MiniDLNA CVE-2020-28926.
Fixed OpenVPN CWE 134 issue.
Fixed ffmpeg CVE-2022-3964 / CVE-2022-48434 / CVE-2022-3109.
Fixed command injection issues.
Fixed cURL CVE-2023-28322, CVE-2023-28319.
Updated libxml2 to version 2.10.4.
Fixed Brute Force Protection for SSH and telnet server.
Fixed AiCloud ZDI-CAN-16078.
Fixed the vulnerability in the logmessage function.

Feature:
Add Surfshark in VPN Fusion allows you to surf the internet anonymously and securely from anywhere by encrypting connections. Please refer to https://asus.click/SurfsharkVPN.
Fixed AiMesh related bugs.
Fixed minor GUI bugs.
Fixed AiCloud ftpclient login issue.
Fixed ipv6 network service filter issue.
Enhanced Dual-WAN fail-over/fail-back. Fixed switching Operation Mode.
Fixed resource leak issues.
Updated OpenVPN server for the compatibility with OpenVPN 2.6 client.
Fixed bandwidth limiter rule not to restart in mesh node.
Fixed possible system crash issue with setting WireGuard VPN Fusion.

Please unzip the firmware file, and then verify the checksum.
SHA256: bcfb656013c80c6cd3011c28c73a10cf60eb7ee5bdc474528b72fe447a99a4b6

Security Fixes and Improvements:
- Update OpenVPN to 2.4.12 for CVE-2022-0547.
- Update strongswan to 5.9.8 for CVE-2021-45079, CVE-2022-40617.
- Fixed status page HTML vulnerability. Thanks to David Ward.
- Fixed busybox CVE-2022-28391, CVE-2021-42386, CVE-2021-42384, CVE-2021-42382, CVE-2021-42383, CVE-2021-42379, CVE-2021-42380, CVE-2021-42385, CVE-2021-30065.
- Fixed dropbear CVE-2019-17362.
- Updated cURL to 7.84.0.
- Updated libexif to 0.6.24.
- Fixed ntp libevent: CVE-2016-10195, CVE-2016-10196, CVE-2016-10197, isc: fix CVE-2018-5743, CVE-2012-3868
- Updated ffmpeg to version 4.4.2.
- Fxied open redirect vulnerability of web page.
- Updated libssh2 to version 1.10.0 for CVE-2019-17498.
- Fixed cfg_server security issue.
- Fixed HTTP response splitting vulnerability. Thanks to Efstratios Chatzoglou, University of the Aegean.

New Features:
- Supported WireGuard VPN server and client.
- Supported VPN fusion. It can easily achieve VPN connection to network devices like Smart TV, Game consoles and without installing the VPN client software.
- Supported new devices connection notification.
- Supported connection diagnostic on the ASUS router app.
- Supported Instant Guard 2.0 which helps easily invite family or friends to join the VPN connection.
- Upgraded parental control and added reward, new scheduler for flexible setting.
- Supported Auto USB Backup WAN.

Bug Fixes and Improvements:
- Enhanced OpenVPN Client profile parser to support option "ignore-unknown-option".
- Enhanced DDNS to select method to register IPv4 address automatically.
- Updated DSL PHY to A2x028b, A2pv6L047k by default.
- Added DDNS HE.NET support.
- Fixed and enhanced AiMesh related issues.
- Updated OOKLA to 3.8.0.
- Fixed dhd TRAP type 0x4 @ epc 0x39792 case.
- Fixed 5G 160MHz download throughput issue.
- Fixed Block-ACK transmission power have chance to over expectation.
- Added iPhone USB tethering connection support.
- Updated default timeout of DNS query in Networking Monitoring .
- Fixed possible crash issue while using OpenVPN.
- Disabled insecure DSS support of SSH server.
- Fixed IPv6 firewall issue when enabled IPv4 Firewall.
- Fixed the device list on the left side of Web AiCloud cannot correctly display connected devices.
- Fixed Windows 10/11 (22H2) client cannot establish connection with IPsec VPN server.
- Enhanced IPSec server to support packet size exceeds 32K bytes.
- Fixed httpd login lock time issue.
- Fixed memory leak issue of conn_diag.

Please unzip the firmware file first then check the MD5 code.
MD5: 8197deaeaf130372c0de6cb3e89625df

Security
- Fixed string format stacks vulnerability
- Fixed cross-site-scripting vulnerability
- Fixed informational vulnerability. Thanks to Howard McGreehan.
- Fixed SQL injection vulnerability
- Fixed json file traversal vulnerability
- Fixed plc/port file traversal vulnerability
- Fixed stack overflow vulnerability. Thanks to HP of Cyber Kunlun Lab
- Fixed authenticated stored XSS vulnerability. Thanks to Luke Walker – SmartDCC
- Fixed cfgserver heap overflow vulnerability
- Fixed cfgserver denial of service vulnerability. Thanks to TianHe from BeFun Cyber Security Lab.
- Fixed OpenSSL CVE-2022-0778
- Fixed CVE-2021-34174
- Added more security measures to block malware.
- Fixed Stored XSS vulnerability. Thanks to Milan Kyselica of IstroSec.
- Fixed CVE-2022-23970, CVE-2022-23971, CVE-2022-23972, CVE-2022-23973, CVE-2022-25595, CVE-2022-25596, CVE-2022-25597, CVE-2022-26376

Bug fixes
- Fixed AiMesh guest network issues.
- Fixed DDNS issues where the WAN IP is IPv6
- Fixed UI bugs in Administration --> feedback.
- Fixed time zone error.
- Fixed Aura RGB issue.
- Fixed Internet connection issue for specific ISPs.

New features
- Added 3rd party DNS server list in WAN --> DNS to help users enhance the connection security.
- Supported Safe Browsing in the router app to filter explicit content from search results. You can set it in the router app --> Devices or Family.

Please unzip the firmware file first then check the MD5 code.
MD5: decefd75eca049b45c91917ea6810631

Security Fixes and Improvements:
- Fixed ZDI-CAN-16036.
- Fixed lighttpd may execute any command.
- Update OpenSSL to 1.1.1n for CVE-2022-0778.
- Fixed HTTP smuggling issue of httpd.
- Fixed arbitrary file reading vulnerability of httpd.
- Fixed unauthorization DoS issue.
- Fixed stack overflow issue of eapd.
- Fixed string format stacks vulnerability, cross-site-scripting vulnerability and informational vulnerability. Thanks to Howard McGreehan.
- Fixed authenticated stored XSS vulnerability. Thanks to Luke Walker - SmartDCC.
- Fixed SQL injection vulnerability, json file traversal vulnerability, plc/port file traversal vulnerability, stack overflow vulnerability. Thanks to HP of Cyber Kunlun Lab.
- Fixed LPD denial of service vulnerability, cfgserver heap overflow vulnerability, cfgserver denial of service vulnerability. Thanks to TianHe from BeFun Cyber Security Lab.
- Fixed CVE-2015-9261, CVE-2017-15873, CVE-2021-28831, CVE-2021-34174.

Bug Fixes and Improvements:
- Fixed and enhanced AiMesh related issues.
- Fixed and enhanced AiCloud related issues.
- Fixed minor GUI bugs.
- Fixed IPv6 related issues.
- Fixed OpenVPN related issues.
- Enhanced Fail-Back with Network Monitoring.
- Fixed igmp snooping cannot enable/disable.

Please unzip the firmware file first then check the MD5 code.
MD5: fa0dfc12186e7e4065a0c8336c19a964

1. Fix GUI issue.
2. Fix bugs during setup wizard.

Please unzip the firmware file first then check the MD5 code.
MD5: 4fe1bf2879516744926b33d60d799de2

Security Fixes:
- Fixed XSS on login page.
- Fixed Buffer Overflow issue of httpd.
Bug Fixes:
- Fixed and enhanced AiMesh/Guest network related issues.
- Added AP mode support.
- Fixed sometimes ipv6 not work.
- Fixed IPTV not apply correctly.
- Update DSL diagnostic to capture training data.
- Fixed Parental Control not work when Network Service Filter is enabled.
- Fixed PPTP/L2TP client not start automatically.
- Fixed internet connection issue if setting LAN DNS in WAN.
- Fixed stability adjustment not work for VDSL2.Security Fixes:
- Fixed XSS on login page.
- Fixed Buffer Overflow issue of httpd.
Bug Fixes:
- Fixed and enhanced AiMesh/Guest network related issues.
- Added AP mode support.
- Fixed sometimes ipv6 not work.
- Fixed IPTV not apply correctly.
- Update DSL diagnostic to capture training data.
- Fixed Parental Control not work when Network Service Filter is enabled.
- Fixed PPTP/L2TP client not start automatically.
- Fixed internet connection issue if setting LAN DNS in WAN.
- Fixed stability adjustment not work for VDSL2.

Please unzip the firmware file first then check the MD5 code.
MD5: 7972dc2fccf929e37ac7643fc5fcbb8f

- Initial Release

Please unzip the firmware file first then check the MD5 code.
MD5: 5390e99fc39b80d920bfc6600f08d45b