RT-N66R

This model was end of its life, and its firmware, utility, website, and manual will no longer be updated. For more details, please refer to https://www.asus.com/event/network/eol-product/

1. Enhanced input parameter handling techniques to improve data processing stability and system security.
2. Enhance system access control mechanisms.

*Notice:
(If your router's firmware version is 3.0.0.4.382_52272 / 3.0.0.4.382_52711 / 3.0.0.4.382_52728 / 3.0.0.4.382_52734)
Please follow the steps below carefully BEFORE upgrading the firmware to avoid potential issues:
1.Go to Wireless settings and set both 2.4GHz and 5GHz bands to Fixed Channel
2.Reboot the router
3.Proceed with the firmware update
4.After the firmware update, the 2.4GHz and 5GHz channels can be set to either Auto or Fixed, depending on your preference.

This model was end of its life, and its firmware, utility, website, and manual will no longer be updated. For more details, please refer to https://www.asus.com/event/network/eol-product/
Please unzip the firmware file, and then verify the checksum.
SHA256: 81a9fdb9ebe4d2cac31317630a9614fad6b4b7336c1ee24e0371ea182327ca90

1. Strengthened input validation and data processing workflows to further protect information security.
2. Enhanced AiCloud password protection mechanisms, safeguarding against unauthorized access attempts.
3. Enhanced device security through improved buffer handling in connection features.
4. Refined data handling processes, ensuring secure and accurate information management.
5. Enhanced file access control mechanisms, promoting a more secure operating environment.
6. Strengthened certificate protection, providing enhanced data security.

1.Strengthened system code execution processes.
2.Enhanced AiCloud password protection mechanisms, safeguarding against unauthorized access attempts.
3.Refined input validation in the web interface, ensuring a more secure web interaction environment.
4.Improved data export functionality in the admin portal, ensuring accurate and secure handling of client information.
5.Optimized memory management mechanisms, improving system stability.
6.Improved system buffer management, ensuring reliable data processing workflows.
7.Enhanced stack buffer management, promoting greater system stability.

Please unzip the firmware file, and then verify the checksum.
SHA256: 2b3f87b5879997345b0f7ec279c6d1b9dce2a2fd746807c6c7a323723f063238

Security update
- Fixed WPS issue to improve network security.
- Resolved a security vulnerability in AiCloud.
- Fixed CVE-2020-12695.
- Fixed CVE-2017-15653.
- Fixed Reflected XSS vulnerability.
- Addressed a directory traversal vulnerability for improved system security.

Please unzip the firmware file, and then verify the checksum.
SHA256: a73bf42d35a561953c730dac38dc0fb869d4e56428af748703218c18b7ed73c1

- Fixed CVE-2018-20334
- Fixed CVE-2018-20336
- Fixed null pointer issue.
- Fixed DDoS vulnerability.
- Fixed command injection vulnerability.
- Fixed buffer overflow vulnerability.
- Updated OTA function.

Please unzip the firmware file first then check the MD5 code.
MD5: 1c42577ee323c273eec006b99ad635c6

- Fix a DDoS vulnerability.

Please unzip the firmware file first then check the MD5 code.
MD5: a92ef54c320871859fe40c2678fd35de

- Fixed firmware update notification bugs.
- Fixed dual wan user interface bugs.

Please unzip the firmware file first then check the MD5 code.
MD5: af3f30bd70e4bc394782211209515a10

Security Fix

- Fixed DDoS vulnerability.

- Fixed AiCloud vulnerability. Thanks for Matt Cundari's contribution.

- Fixed command injection vulnerability. Thanks for S1mba Lu's contribution.

- Fixed buffer overflow vulnerability. Thanks for Javier Aguinaga's contribution.

- Fixed CVE-2018-20334

- Fixed CVE-2018-20336

- Fixed null pointer issue. Thanks for CodeBreaker of STARLabs’ contribution.

- Fixed AiCloud buffer overflow vulnerability. Thanks for Resecurity International's contribution.



Please unzip the firmware file first then check the MD5 code.
MD5: f4bda506824b9b82ee2594c1ec397f8a

- Fixed bugs.
- Improved system stability.


Please unzip the firmware file first then check the MD5 code.
MD5: 5b0ab9d736dc73001c315a6d83329966

- Support multi-language (UTF-8) network name
(Windows XP and Windows 7 do not support UTF-8 format SSID. These two OS may see gibberish if using multi-language SSID.)
- Improved system stability.
- Fixed XSS vulnerability. Thanks to Yonghui Han of Fortinet's FortiGuard Labs.
- Fixed CVE-2018-8877, CVE-2018-8878, CVE-2018-8879
- Fixed plain text password vulnerability in lighttpd.
- Fixed AiCloud cannot login issue.
- Modified Quick Internet Setup wizard process.
- Main SSID and guest network can hide independently.

Please unzip the firmware file first then check the MD5 code.
MD5: 906ff822635bb62e724b64a5e84c3ec3

- Fixed information disclosure vulnerability. Thanks to Haitan Xiang and Fand Wang.
- Fixed CVE-2018-5721 Stack-base buffer overflow vulnerability
- Fixed CVE-2018-8826 remote code code execution vulnerability. Thanks to Chris Wood.
- Fixed CVE-2018-5999 HTTP authorization bypass and CVE-2018-6000. An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program
- Fixed remote code execution vulnerability. Thanks to David Maciejak of Fortinet's FortiGuard Labs

- Fixed CVE-2017-14491: DNS - 2 byte heap based overflow
- Fixed CVE-2017-14492: DHCP - heap based overflow
- Fixed CVE-2017-14493: DHCP - stack based overflow
- Fixed CVE-2017-14494: DHCP - info leak
- Fixed CVE-2017-14495: DNS - OOM DoS
- Fixed CVE-2017-14496: DNS - DoS Integer underflow
- Fixed CVE-2017-13704: Bug collision
- Fixed AiCloud 2.0 Reflected XSS Vulnerability. Thanks to Guy Arazi and Niv Levi contribution.

Thanks to Guy Arazi for following vulnerabilities.
- AiCloud 2.0 Stored XSS Share link manager.
- AiCloud 2.0 Reflected XSS - "share a link"
- Download Master HTTP service DoS vulnerability.
- Download Master Reflected XSS Main login.

Please unzip the firmware file first then check the MD5 code.
MD5: 2c287b2686dda7550752eb7989ae5904

Security fixed
- Fixed KRACK vulnerability
- Fixed CVE-2017-14491: DNS - 2 byte heap based overflow
- Fixed CVE-2017-14492: DHCP - heap based overflow
- Fixed CVE-2017-14493: DHCP - stack based overflow
- Fixed CVE-2017-14494: DHCP - info leak
- Fixed CVE-2017-14495: DNS - OOM DoS
- Fixed CVE-2017-14496: DNS - DoS Integer underflow
- Fixed CVE-2017-13704 : Bug collision
- Fixed predictable session tokens, logged user IP validation, Logged-in information disclosure (special thanks for Blazej Adamczyk contribution)
- Fixed web GUI authorization vulnerabilities.
- Fixed AiCloud XSS vulnerabilities


Please unzip the firmware file first then check the MD5 code.
MD5: 9c01a77e141dbd8807a3f35265f812ed

Security fixed
- Fixed CVE-2017-8828 (XSS vulnerability special for Yair Amit’s https://www.linkedin.com/in/yairamit/ contribution)
- Fixed CVE-2017-5892 (JSONP Information Disclosure)
- Fixed CVE-2017-7494 (Samba remote code execution vulnerability)
- Improved brute-force protection for SSH, Telnet connection.

Bug fixed
- Fixed URL filter, keyword filter, network filter time related issue.
- Fixed USB Modem/ Tethering UI issue.


Please unzip the firmware file first then check the MD5 code.
MD5: 6ae719a6179aab0659f465a492eee648

Security fixed
- Fixed CVE-2017-5891.
- Fixed CVE-2017-5892.
- Fixed CVE-2017-6547.
- Fixed CVE-2017-6549.
- Fixed CVE-2017-6548.
- Added log message for brute force attack.

Bug fixed
- Fixed bandwidth limiter bugs.
- Fixed UI issue when using Chrome 56.
- Fixed smart sync bugs.


Please unzip the firmware file first then check the MD5 code.
MD5: c49453059e9c176bafd9697a65332a4c