An Active Debug Code vulnerability in certain ASUS router models

#!/usr/bin/env bash
# CVE-2026-13313 — ASUS Router Active Debug Code Checker
# Checks: (1) Telnet port 23 status (compromise indicator)
#         (2) Firmware version against affected series
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -uo pipefail

ROUTER_IP="${1:-}"
ADMIN_USER="${2:-admin}"
ADMIN_PASS="${3:-}"

if [[ -z "$ROUTER_IP" ]]; then
    echo "Usage: $0 <router_ip> [admin_user] [admin_password]"
    echo "UNKNOWN - missing router IP"
    exit 2
fi

VULN=0
COOKIE_FILE=$(mktemp /tmp/asus_cookie.XXXXXX)
trap "rm -f $COOKIE_FILE" EXIT

# --- Check 1: Telnet port indicator (compromise detection) ---
echo "[*] Checking Telnet port 23 on $ROUTER_IP ..."
if nc -z -w3 "$ROUTER_IP" 23 2>/dev/null; then
    echo "[!] WARNING: Telnet port 23 is OPEN — debug code may be active or device compromised"
    VULN=1
else
    echo "[+] Telnet port 23 is closed (expected)"
fi

# --- Check 2: Firmware version via ASUSWRT web API ---
if [[ -n "$ADMIN_PASS" ]]; then
    echo "[*] Authenticating to web management on $ROUTER_IP ..."
    AUTH_TOKEN=$(echo -n "${ADMIN_USER}:${ADMIN_PASS}" | base64)
    PROTO="https"

    LOGIN_RESP=$(curl -sk -c "$COOKIE_FILE" \
        "${PROTO}://${ROUTER_IP}/login.cgi" \
        -d "login_authorization=${AUTH_TOKEN}" \
        --connect-timeout 10 --max-time 15 2>/dev/null)

    # Fallback to HTTP if HTTPS fails
    if [[ -z "$LOGIN_RESP" ]]; then
        PROTO="http"
        LOGIN_RESP=$(curl -sk -c "$COOKIE_FILE" \
            "${PROTO}://${ROUTER_IP}/login.cgi" \
            -d "login_authorization=${AUTH_TOKEN}" \
            --connect-timeout 10 --max-time 15 2>/dev/null)
    fi

    if [[ -z "$LOGIN_RESP" ]]; then
        echo "[!] Could not connect to router web interface"
        if [[ $VULN -eq 1 ]]; then
            echo "VULNERABLE - Telnet port open (firmware check inconclusive)"
            exit 1
        fi
        echo "UNKNOWN - could not connect; provide correct IP and credentials"
        exit 2
    fi

    # Query firmware version via appGet API
    FW_RESP=$(curl -sk -b "$COOKIE_FILE" \
        "${PROTO}://${ROUTER_IP}/appGet.cgi" \
        -d 'hook=nvram_get(firmver)%3Bnvram_get(buildno)%3Bnvram_get(extendno)%3Bnvram_get(model)' \
        --connect-timeout 10 --max-time 15 2>/dev/null)

    FIRMVER=$(echo "$FW_RESP" | grep -oP '"firmver"\s*:\s*"\K[^"]+' 2>/dev/null || echo "")
    BUILDNO=$(echo "$FW_RESP" | grep -oP '"buildno"\s*:\s*"\K[^"]+' 2>/dev/null || echo "")
    MODEL=$(echo "$FW_RESP" | grep -oP '"model"\s*:\s*"\K[^"]+' 2>/dev/null || echo "unknown")

    if [[ -n "$FIRMVER" && -n "$BUILDNO" ]]; then
        FULL_VER="${FIRMVER}_${BUILDNO}"
        echo "[*] Model: $MODEL | Firmware: $FULL_VER"

        # Affected series: 3.0.0.4_386*, 3.0.0.4_388*, 3.0.0.6_102*
        if [[ "$FULL_VER" =~ ^3\.0\.0\.4_386 ]] || \
           [[ "$FULL_VER" =~ ^3\.0\.0\.4_388 ]] || \
           [[ "$FULL_VER" =~ ^3\.0\.0\.6_102 ]]; then
            echo "VULNERABLE - firmware $FULL_VER on $MODEL is in affected series (CVE-2026-13313)"
            echo "[!] Update firmware: https://www.asus.com/security-advisory"
            exit 1
        else
            if [[ $VULN -eq 1 ]]; then
                echo "VULNERABLE - Telnet port open despite firmware outside known-affected series (investigate)"
                exit 1
            fi
            echo "PATCHED - firmware $FULL_VER is not in the affected series"
            exit 0
        fi
    else
        echo "[!] Could not parse firmware version from API response"
    fi
else
    echo "[*] No credentials provided — skipping firmware version check"
fi

# Final determination
if [[ $VULN -eq 1 ]]; then
    echo "VULNERABLE - Telnet port 23 is open (possible active exploitation)"
    exit 1
fi

echo "UNKNOWN - provide admin credentials for firmware version check"
exit 2