If you're running an Asus wireless router, chances are good that someone inside your network can take full administrative control of it thanks to a currently unpatched vulnerability in virtually all versions of the firmware, a security researcher said.

While the vulnerability isn't as serious as those that allow hackers on the Internet at large to compromise the devices , it's nonetheless concerning. People with administrative control can reroute everyone connected to malicious websites and possibly install alternate or even malicious firmware updates.

"I trust people that join my network to some degree, but I don't want them to be able to reconfigure the router," Joshua Drake, research director at Accuvant and the person who brought the vulnerability to light Thursday, told Ars. "I can't prevent them without this getting fixed (short of the workaround)."

The vulnerability stems from a poorly coded service known as infosvr, which monitors the local area network for other connected routers. Infosvr runs with unfettered root privileges and contains an unauthenticated command execution bug. The result: anyone connected to the local network can gain control by sending a single user datagram protocol packet to the router. Drake said virtually all Asus wireless routers are susceptible. He said testing showed firmware version 3.0.0.376.2524-g0013f52 was vulnerable, but he assumes all other versions are also affected. The bug has been designated CVE-2014- 10000 9583.

Unless Asus releases a patch, there's little non-technical users can do to close the hole. More technically inclined people can use the vulnerability itself to turn off infosvr after each reboot. They can use the following command to do so.

$ ./asus-cmd "killall -9 infosvr"

[...]

Over the past 18 months, wireless routers from a variety of manufacturers have emerged as a popular target of in-the-wild hacks. Again, this latest vulnerability affecting Asus users is less serious since it doesn't permit hackers halfway around the world to gain entry. But it still could pose major problems for some people, particularly those who use Asus routers to run hotspots or other public Wi-Fi networks.