Device Support-Lifespan Observatory

What vendors do, not what they announce.

ASUS

DSL-AX82U

Actively updated well evidenced

firmware is arriving about as often as it always has

16 days since the last release against a median gap of 162 (0.1x)

Sign in to be emailed when this verdict changes.
Last firmware
14 September 2026 (16 days ago)
Releases seen
11
Update rhythm
about every 5 months
Support observed
≥5 years
Vendor's promise
no support period we can evaluate
Patch latency
not measurable — its changelogs name no CVE ids

Firmware history

  1. 3.0.0.4.388_25052 14 September 2026

    Release notes — disclosure 0.45 
    Security FixesStrengthened data handling in Networks configuration functions.Improved data validation in Networks rule list processing.Fixed a data-handling issue in the DNS query caching component.Strengthened verification when a software component downloads external resources, improving connection security.Adjusted the information response mechanism of the device discovery service, strengthening protection of device information.Fixed a data-handling issue in a firmware component on a specific model.Improved data-display handling in a web function to enhance browsing security.Strengthened input data validation in a device-pairing web function.Improved data validation in the configuration file upload/sync function.Improved how the account service restart process is handled.Removed a non-essential internal function endpoint, strengthening overall access control.Adjusted the debug file access mechanism, strengthening protection of internal data.Strengthened data handling in the system logging function.We recommend upgrading to this version to maintain optimal protection.

    Archived page, fetched 29 September 2026

  2. 3.0.0.4.388_24919 2 May 2025

    Release notes — disclosure 0.56 
    1. Fixed the UI issue in Chrome.2. Fixed client binding issues in Mesh scenarios.3. Enhanced input parameter handling techniques to improve data processing stability and system security.4. Enhance system access control mechanisms.5. Improved system stability and security by fixing a kernel integrity validation issue.

    Archived page, fetched 29 September 2026

  3. 3.0.0.4.388_24906 9 December 2024

    Release notes — disclosure 0.58 
    1. Strengthened input validation and data processing workflows to further protect information security.2. Enhanced AiCloud password protection mechanisms, safeguarding against unauthorized access attempts.3. Enhanced device security through improved buffer handling in connection features.4. Refined data handling processes, ensuring secure and accurate information management.5. Enhanced file access control mechanisms, promoting a more secure operating environment.6. Strengthened certificate protection, providing enhanced data security.

    Archived page, fetched 29 September 2026

  4. 3.0.0.4.388_24894 21 June 2024

    Cites CVE-2023-48795, CVE-2024-0401

    Release notes — disclosure 0.80 
    Security Fixes and Improvements:- Update dnsmasq to 2.90.- Update dropbear to 2022.82 and fix CVE-2023-48795.- Update StrongSwan to 5.9.13.- Fixed the vulnerability in eapd.- Fixed the vulnerability in httpd.- Fixed CVE-2024-0401.- Fixed AiCloud related issues.Bug Fixes and Improvements:- Added device binding support of the first guest network.- Added WireGuard client MTU option.- Added Xiaomi phone USB tethering support.- Added IPv6 Access restriction rules (Web/SSH/Telnet) support.- Added DDNS services FreeDNS and FreeMyIP support.- Added IPv6 information in NetworkMap.- Added IPv6 addresses for the client of WireGuard server if enable IPv6.- Added Samba IPv6 support.- Added the edit mode for DHCP server Manual Assignment.- Updated the generation and usage of Router certificate.- Updated to support 50 IGMP member.- Updated Privacy Policy and EULA.- Fixed the client cannot access network if OpenVPN server setting with TAP + DHCP.- Fixed time zone 'Saint Pierre, Miquelon' with DST settings.- Fixed getting IPv6 address from WAN if setting Bridge service.- Fixed the issue of removing iPhone's first interface.- Fixed DDNS issue and enhanced the control flow.- Fixed disable and enable WireGUard server sometimes cause the router reboot.- Fixed cannot access WireGuard Server if enable DMZ.- Fixed AiMesh related issues.- Fixed Network Server Filter apply failed.- Fixed client status of wireguard server sometimes be incorrect. - Fixed Dual WAN load-balance issue when both of WAN are "Static IP".- Fixed router LAN devices configured using specific WAN when enabled Load Balance, client of VPN server could not access those LAN devices.- Fixed adding two or greater online mode rules for a day, the client cannot access internet in online period.- Fixed zone issue.- Fixed sometimes continuous feedback and then reboot issue.- Fixed getting IPv6 address from the server on no vlan interface even enable 802.1Q.- Fixed Parental Control issues.- Fixed OpenVPN server not show IPv6 settings correctly with new RWD UI.- Fixed telnet server terminated periodically if IPv6 enabled.- Fixed LED related issue. - Fixed VPN FUSION IPv6 default connection not changed if setting Internet Connection as default connection.Please unzip the firmware file, and then verify the checksum.SH256: 5c142b384473e65861ab6a5ed40000bd43da7fb7160b9693c64dc05592eca821

    Archived page, fetched 29 September 2026

  5. 3.0.0.4.388_23756 11 August 2023

    Cites CVE-2020-28926, CVE-2022-3109, CVE-2022-3964, CVE-2022-46871, CVE-2022-48434, CVE-2023-28319, CVE-2023-28322

    Release notes — disclosure 0.95 
    Security:Fixed Client DOM Stored XSS.Fixed CVE-2022-46871.Fixed httpd command injection vulnerabilities.Fixed httpd DoS vulnerabilities.Fixed httpd integer overflow vulnerability.Fixed httpd Null Pointer Dereference vulnerabilities.Fixed lighttpd command injection vulnerability.Fixed not secure cookies when using https.Fixed cfg server security issues.Fixed Stored Cross Site Scripting.Updated OpenSSL to version 1.1.1t for CVE vulnerabilities.Fixed XSS attack via USB EXT3 foldername.Fixed Stored Cross Site Scripting. Thanks to Howard McGreehan.Fixed XSS attack via malformed hostname in DHCP requestFixed MiniDLNA CVE-2020-28926.Fixed OpenVPN CWE 134 issue.Fixed ffmpeg CVE-2022-3964 / CVE-2022-48434 / CVE-2022-3109.Fixed command injection issues.Fixed cURL CVE-2023-28322, CVE-2023-28319.Updated libxml2 to version 2.10.4.Fixed Brute Force Protection for SSH and telnet server.Fixed AiCloud ZDI-CAN-16078.Fixed the vulnerability in the logmessage function.Feature:Add Surfshark in VPN Fusion allows you to surf the internet anonymously and securely from anywhere by encrypting connections. Please refer to https://asus.click/SurfsharkVPN.Fixed AiMesh related bugs.Fixed minor GUI bugs.Fixed AiCloud ftpclient login issue.Fixed ipv6 network service filter issue.Enhanced Dual-WAN fail-over/fail-back. Fixed switching Operation Mode.Fixed resource leak issues.Updated OpenVPN server for the compatibility with OpenVPN 2.6 client.Fixed bandwidth limiter rule not to restart in mesh node.Fixed possible system crash issue with setting WireGuard VPN Fusion.

    Archived page, fetched 29 September 2026

  6. 3.0.0.4.388_22048 29 December 2022

    Cites CVE-2012-3868, CVE-2016-10195, CVE-2016-10196, CVE-2016-10197, CVE-2018-5743, CVE-2019-17362, CVE-2019-17498, CVE-2021-30065, CVE-2021-42379, CVE-2021-42380, CVE-2021-42382, CVE-2021-42383, CVE-2021-42384, CVE-2021-42385, CVE-2021-42386, CVE-2021-45079, CVE-2022-0547, CVE-2022-28391, CVE-2022-40617

    Release notes — disclosure 0.95 
    Security Fixes and Improvements:- Update OpenVPN to 2.4.12 for CVE-2022-0547.- Update strongswan to 5.9.8 for CVE-2021-45079, CVE-2022-40617.- Fixed status page HTML vulnerability. Thanks to David Ward.- Fixed busybox CVE-2022-28391, CVE-2021-42386, CVE-2021-42384, CVE-2021-42382, CVE-2021-42383, CVE-2021-42379, CVE-2021-42380, CVE-2021-42385, CVE-2021-30065.- Fixed dropbear CVE-2019-17362.- Updated cURL to 7.84.0.- Updated libexif to 0.6.24.- Fixed ntp libevent: CVE-2016-10195, CVE-2016-10196, CVE-2016-10197, isc: fix CVE-2018-5743, CVE-2012-3868- Updated ffmpeg to version 4.4.2.- Fxied open redirect vulnerability of web page.- Updated libssh2 to version 1.10.0 for CVE-2019-17498.- Fixed cfg_server security issue.- Fixed HTTP response splitting vulnerability. Thanks to Efstratios Chatzoglou, University of the Aegean.New Features:- Supported WireGuard VPN server and client.- Supported VPN fusion. It can easily achieve VPN connection to network devices like Smart TV, Game consoles and without installing the VPN client software.- Supported new devices connection notification.- Supported connection diagnostic on the ASUS router app.- Supported Instant Guard 2.0 which helps easily invite family or friends to join the VPN connection.- Upgraded parental control and added reward, new scheduler for flexible setting.- Supported Auto USB Backup WAN.Bug Fixes and Improvements:- Enhanced OpenVPN Client profile parser to support option "ignore-unknown-option".- Enhanced DDNS to select method to register IPv4 address automatically.- Updated DSL PHY to A2x028b, A2pv6L047k by default.- Added DDNS HE.NET support.- Fixed and enhanced AiMesh related issues.- Updated OOKLA to 3.8.0.- Fixed dhd TRAP type 0x4 @ epc 0x39792 case.- Fixed 5G 160MHz download throughput issue.- Fixed Block-ACK transmission power have chance to over expectation.- Added iPhone USB tethering connection support.- Updated default timeout of DNS query in Networking Monitoring .- Fixed possible crash issue while using OpenVPN.- Disabled insecure DSS support of SSH server.- Fixed IPv6 firewall issue when enabled IPv4 Firewall.- Fixed the device list on the left side of Web AiCloud cannot correctly display connected devices.- Fixed Windows 10/11 (22H2) client cannot establish connection with IPsec VPN server.- Enhanced IPSec server to support packet size exceeds 32K bytes.- Fixed httpd login lock time issue.- Fixed memory leak issue of conn_diag.

    Archived page, fetched 29 September 2026

  7. 3.0.0.4.386.49608 28 July 2022

    Cites CVE-2021-34174, CVE-2022-0778, CVE-2022-23970, CVE-2022-23971, CVE-2022-23972, CVE-2022-23973, CVE-2022-25595, CVE-2022-25596, CVE-2022-25597

    Release notes — disclosure 1.00 
    Security- Fixed string format stacks vulnerability- Fixed cross-site-scripting vulnerability- Fixed informational vulnerability. Thanks to Howard McGreehan.- Fixed SQL injection vulnerability- Fixed json file traversal vulnerability- Fixed plc/port file traversal vulnerability- Fixed stack overflow vulnerability. Thanks to HP of Cyber Kunlun Lab- Fixed authenticated stored XSS vulnerability. Thanks to Luke Walker – SmartDCC- Fixed cfgserver heap overflow vulnerability- Fixed cfgserver denial of service vulnerability. Thanks to TianHe from BeFun Cyber Security Lab.- Fixed OpenSSL CVE-2022-0778- Fixed CVE-2021-34174- Added more security measures to block malware.- Fixed Stored XSS vulnerability. Thanks to Milan Kyselica of IstroSec.- Fixed CVE-2022-23970, CVE-2022-23971, CVE-2022-23972, CVE-2022-23973, CVE-2022-25595, CVE-2022-25596, CVE-2022-25597, CVE-2022-26376Bug fixes- Fixed AiMesh guest network issues.- Fixed DDNS issues where the WAN IP is IPv6- Fixed UI bugs in Administration --> feedback.- Fixed time zone error.- Fixed Aura RGB issue.- Fixed Internet connection issue for specific ISPs.New features- Added 3rd party DNS server list in WAN --> DNS to help users enhance the connection security.- Supported Safe Browsing in the router app to filter explicit content from search results. You can set it in the router app --> Devices or Family.

    Archived page, fetched 29 September 2026

  8. 3.0.0.4.386_48378 7 April 2022

    Cites CVE-2015-9261, CVE-2017-15873, CVE-2021-28831, CVE-2021-34174, CVE-2022-0778

    Release notes — disclosure 1.00 
    Security Fixes and Improvements:- Fixed ZDI-CAN-16036.- Fixed lighttpd may execute any command.- Update OpenSSL to 1.1.1n for CVE-2022-0778.- Fixed HTTP smuggling issue of httpd.- Fixed arbitrary file reading vulnerability of httpd.- Fixed unauthorization DoS issue.- Fixed stack overflow issue of eapd.- Fixed string format stacks vulnerability, cross-site-scripting vulnerability and informational vulnerability. Thanks to Howard McGreehan.- Fixed authenticated stored XSS vulnerability. Thanks to Luke Walker - SmartDCC.- Fixed SQL injection vulnerability, json file traversal vulnerability, plc/port file traversal vulnerability, stack overflow vulnerability. Thanks to HP of Cyber Kunlun Lab.- Fixed LPD denial of service vulnerability, cfgserver heap overflow vulnerability, cfgserver denial of service vulnerability. Thanks to TianHe from BeFun Cyber Security Lab.- Fixed CVE-2015-9261, CVE-2017-15873, CVE-2021-28831, CVE-2021-34174.Bug Fixes and Improvements:- Fixed and enhanced AiMesh related issues.- Fixed and enhanced AiCloud related issues.- Fixed minor GUI bugs.- Fixed IPv6 related issues.- Fixed OpenVPN related issues.- Enhanced Fail-Back with Network Monitoring.- Fixed igmp snooping cannot enable/disable.

    Archived page, fetched 29 September 2026

  9. 3.0.0.4.386_43600 6 August 2021

    Release notes — disclosure 0.36 
    1. Fix GUI issue.2. Fix bugs during setup wizard.

    Archived page, fetched 29 September 2026

  10. 3.0.0.4.386_43563 17 June 2021

    Release notes — disclosure 0.55 
    Security Fixes: - Fixed XSS on login page. - Fixed Buffer Overflow issue of httpd. Bug Fixes: - Fixed and enhanced AiMesh/Guest network related issues. - Added AP mode support. - Fixed sometimes ipv6 not work. - Fixed IPTV not apply correctly. - Update DSL diagnostic to capture training data. - Fixed Parental Control not work when Network Service Filter is enabled. - Fixed PPTP/L2TP client not start automatically. - Fixed internet connection issue if setting LAN DNS in WAN. - Fixed stability adjustment not work for VDSL2.Security Fixes: - Fixed XSS on login page. - Fixed Buffer Overflow issue of httpd. Bug Fixes: - Fixed and enhanced AiMesh/Guest network related issues. - Added AP mode support. - Fixed sometimes ipv6 not work. - Fixed IPTV not apply correctly. - Update DSL diagnostic to capture training data. - Fixed Parental Control not work when Network Service Filter is enabled. - Fixed PPTP/L2TP client not start automatically. - Fixed internet connection issue if setting LAN DNS in WAN. - Fixed stability adjustment not work for VDSL2.

    Archived page, fetched 29 September 2026

  11. 3.0.0.4.386_42438 20 April 2021

    Release notes — disclosure 0.30 
    - Initial Release

    Archived page, fetched 29 September 2026

Evidence

One archived page sits behind this record, the earliest read on 2 August 2026. Everything above was read from it, and each is kept byte for byte so it can be checked after the vendor edits the original.

Identifiers: marketing_name DSL-AX82U

Judged by lifecycle-1 on 30 September 2026. How these verdicts are computed.

Machine-readable: JSON · RSS