Device Support-Lifespan Observatory

What vendors do, not what they announce.

ASUS

TUF-AX5400

Actively updated well evidenced

firmware is arriving about as often as it always has

34 days since the last release against a median gap of 100 (0.3x)

Sign in to be emailed when this verdict changes.
Last firmware
27 August 2026 (34 days ago)
Releases seen
13
Update rhythm
about every 3 months
Support observed
≥4 years
Vendor's promise
no support period we can evaluate
Patch latency
not measurable — its changelogs name no CVE ids

Firmware history

  1. 3.0.0.4.388_24395 27 August 2026

    Release notes — disclosure 0.45 
    New FeaturesNew Time Zone Options: Added "Vancouver, Whitehorse (PST7)" and "Edmonton, Yellowknife (MST6)" time zone options for Canada.Bug Fixes and EnhancementsImproved stability during the AiMesh node setup process.Strengthened firewall rule configuration for UPnP, improving port-forwarding stability and firewall rule restoration reliability.Security FixesStrengthened data handling in Networks configuration functions.Improved data validation in Networks rule list processing.Fixed a data-handling issue in the DNS query caching component.Strengthened verification when a software component downloads external resources, improving connection security.Adjusted the information response mechanism of the device discovery service, strengthening protection of device information.Fixed a data-handling issue in a firmware component on a specific model.Strengthened input data validation in a device-pairing web function.Improved data validation in the configuration file upload/sync function.Improved how the account service restart process is handled.Removed a non-essential internal function endpoint, strengthening overall access control.Adjusted the debug file access mechanism, strengthening protection of internal data.Strengthened data handling in the system logging function.We recommend upgrading to this version to maintain optimal protection.

    Archived page, fetched 29 September 2026

  2. 3.0.0.4_388_24395 27 August 2026

    Release notes — disclosure 0.45 
    New FeaturesNew Time Zone Options: Added "Vancouver, Whitehorse (PST7)" and "Edmonton, Yellowknife (MST6)" time zone options for Canada.Bug Fixes and EnhancementsImproved stability during the AiMesh node setup process.Strengthened firewall rule configuration for UPnP, improving port-forwarding stability and firewall rule restoration reliability.Security FixesStrengthened data handling in Networks configuration functions.Improved data validation in Networks rule list processing.Fixed a data-handling issue in the DNS query caching component.Strengthened verification when a software component downloads external resources, improving connection security.Adjusted the information response mechanism of the device discovery service, strengthening protection of device information.Fixed a data-handling issue in a firmware component on a specific model.Strengthened input data validation in a device-pairing web function.Improved data validation in the configuration file upload/sync function.Improved how the account service restart process is handled.Removed a non-essential internal function endpoint, strengthening overall access control.Adjusted the debug file access mechanism, strengthening protection of internal data.Strengthened data handling in the system logging function.We recommend upgrading to this version to maintain optimal protection.

    Archived page, fetched 28 August 2026

  3. 3.0.0.4.388_24358 12 May 2026

    Release notes — disclosure 0.35 
    Security Fixes- Enhanced system security by addressing an unsafe remote script execution mechanism in.- Improved system security by addressing a heap buffer overflow vulnerability during cache handling. - We recommend upgrading to this version to ensure up-to-date protection.

    Archived page, fetched 29 September 2026

  4. 3.0.0.4.388_24356 16 April 2026

    Release notes — disclosure 0.37 
    Improvements:Optimized Wi-Fi roaming stability for devices supporting 802.11k but not allowing 11v.Improved Wi-Fi roaming compatibility and stability for iOS 26 devices.Refined accessibility-related UI and interaction details.Improved overall remote connection stability.Security Enhancements:Strengthened input sanitization mechanismEnhanced system API validation for stronger protection consistency.Strengthened command handling and system resource access controls.Improved system logging and security event recording mechanisms.

    Archived page, fetched 29 September 2026

  5. 3.0.0.4.388_24305 27 October 2025

    Release notes — disclosure 0.41 
    - Enhanced system stability.- Enhanced input validation and refactored legacy string handling routines to ensure robust memory management.- Mitigated security risks in AiCloud service by enforcing strict credential verification, implementing robust file path validation, and hardening command execution logic to prevent unauthorized access and manipulation of system resources.- Implemented comprehensive validation and expanded command filtering in the web history API.- Strengthened input validation and directory handling in the VPN configuration upload interface.- Fixed an issue that allowed certain user settings to be bypassed, improving overall user control and protection.

    Archived page, fetched 29 September 2026

  6. 3.0.0.4.388_24206 21 April 2025

    Release notes — disclosure 0.31 
    Improved compatibility with certain IoT devices.

    Archived page, fetched 29 September 2026

  7. 3.0.0.4.388_24205 12 March 2025

    Release notes — disclosure 0.37 
    1. Enhanced input parameter handling techniques to improve data processing stability and system security.2. Enhance system access control mechanisms.

    Archived page, fetched 29 September 2026

  8. 3.0.0.4.388_24202 18 February 2025

    Release notes — disclosure 0.37 
    1. Fixed UI compatibility issues with the latest Chrome.2. Fixed client binding issues in Mesh scenarios.

    Archived page, fetched 29 September 2026

  9. 3.0.0.4.388_24194 22 November 2024

    Release notes — disclosure 0.58 
    1. Strengthened input validation and data processing workflows to further protect information security.2. Enhanced AiCloud password protection mechanisms, safeguarding against unauthorized access attempts.3. Enhanced device security through improved buffer handling in connection features.4. Refined data handling processes, ensuring secure and accurate information management.5. Enhanced file access control mechanisms, promoting a more secure operating environment.6. Strengthened certificate protection, providing enhanced data security.

    Archived page, fetched 29 September 2026

  10. 3.0.0.4.388_24121 9 October 2023

    Cites CVE-2021-27218, CVE-2021-27219, CVE-2022-3109, CVE-2022-3964, CVE-2022-48434, CVE-2023-28319, CVE-2023-28321, CVE-2023-28322, CVE-2023-32643

    Release notes — disclosure 0.80 
    Bug Fixes and Enhancements- Fixed WAN Connection Issue.- Fixed cannot access WireGuard Server if enable DMZ.- Fixed DDNS server error occurs when registering DDNS with app.- Resolved an issue that caused hostname errors in the DDNS service.- NowTV profile has been added under new IPTV profiles.- IPTV settings have been updated for better compatibility with Unifi Biz VoIP service.- Fixed v6plus-Related Issues and.- Resolved OpenVPN Server TAP Mode Issue.- Fixed ipv6 network service filter not work.- Fixed the problem that the Aicloud app cannot add router on Android 9.Security Fixes- Fixed several curl vulnerabilities including CVE-2021-27218, CVE-2021-27219, CVE-2023-28322, CVE-2023-28321, CVE-2023-28319, CVE-2023-32643.- Fixed FFmpeg vulnerabilities, specifically CVE-2022-3964, CVE-2022-48434, and CVE-2022-3109.- Corrected an OpenVPN vulnerability categorized as CWE-134.- Strengthened protection against SSH brute force attacks.- Updated OpenSSL to 1.1.1t for vulnerabilities.

    Archived page, fetched 29 September 2026

  11. 3.0.0.4.388.23285 18 May 2023

    Cites CVE-2023-28702, CVE-2023-28703, CVE-2023-35086, CVE-2023-35087

    Release notes — disclosure 1.00 
    New features:-Built-in Surfshark in VPN Fusion allows you to surf the internet anonymously and securely from anywhere by encrypting connections. Please refer to https://asus.click/SurfsharkVPN-iPhone/Android USB auto backup WAN allows you to connect your phone to the router’s USB port and use it as an internet source. Please refer to https://asus.click/AutobackupWAN-DDNS transfer allows you to transfer your ASUS DDNS hostname from your original router to the new one. Please refer to https://asus.click/ASUSDDNSBug fixes and functionality modifications:-Resolved the issue with login and password changes.-Resolved the IPSec VPN connection issues.-Resolved the Instant Guard connection issues.-Fixed the AiCloud login issue after unplugging and plugging the HDD into the USB port.-Fixed the issue where Traffic Analyzer sometimes couldn't record data.-Fixed the time display issue for the preferred upgrade time in the Auto Firmware Upgrade function.-Fine-tuned the description for port status.-Enabled DynDNS and No-IP DDNS to use IPv6.-Fixed AiMesh preferred AP identification in site survey results.-Updated timezone list for Greenland, Mexico, and Iran.-Modified the USB application option text in dual WAN.-Allowed WireGuard Server clients to access the Samba server.-Fixed memory leak issue.-Enabled the failback function when using the iOS/Android USB backup WAN.-The ARP response issue has been resolved, along with the connection issue between the router and the ROG Phone 6 and 7.-Resolved the issue where the USB path is not displayed on the Media Server page in the AiMesh nodeSecurity updates:-Enabled and supported ECDSA certificates for Let's Encrypt.-Enhanced protection for credentials.-Enhanced protection for OTA firmware updates.-Fixed DoS vulnerabilities in firewall configuration pages. Thanks to Jinghe Gao's contribution.-Fixed DoS vulerabilities in httpd. Thanks to Howard McGreehan.-Fixed information disclosure vulnerability. Thanks to Junxu (Hillstone Network Security Research Institute) contribution.-Fixed CVE-2023-28702 and CVE-2023-28703. Thanks to Xingyu Xu(@tmotfl) contribution.-Fixed null pointer dereference vulnerabilities. Thanks to Chengfeng Ye, Prism Research Group - cse hkust contribution.-Fixed the cfg server vulnerability. Thanks to Swing and Wang Duo from Chaitin Security Research Lab.-Fixed the vulnerability in the logmessage function CVE-2023-35086/ CVE-2023-35087. Thanks to Swing and Wang Duo from Chaitin Security Research Lab C0ss4ck from Bytedance Wuheng Lab, Feixincheng from X1cT34m.

    Archived page, fetched 29 September 2026

  12. 3.0.0.4.388.22525 14 February 2023

    Cites CVE-2022-468712

    Release notes — disclosure 0.70 
    1.Fixed CVE-2022-468712.Fixed Client DOM Stored XSS.3.Improved AiMesh backhaul stability.4.Fixed AiMesh topology UI bugs.5.Fixed the reboot issue when assigning specific clients in VPN fusion.6.Fixed the VPN fusion bug when importing the Surfshark WireGuard conf file.7.Fixed network map bugs.

    Archived page, fetched 29 September 2026

  13. 3.0.0.4.388.21224 21 October 2022

    Cites CVE-2018-1160

    Release notes — disclosure 0.98 
    1. Supported WireGuard VPN server and client.2. Supported VPN fusion. It can easily achieve VPN connection to network devices like Smart TV, Game consoles and without installing the VPN client software.3. Supported new devices connection notification.4. Supported connection diagnostic on the ASUS router app.5. Supported Instant Guard 2.0 which helps easily invite family or friends to join the VPN connection.6. Upgraded parental control and added reward, new scheduler for flexible setting7. Fixed HTTP response splitting vulnerability. Thanks to Efstratios Chatzoglou, University of the Aegean.8. Fixed status page HTML vulnerability. Thanks to David Ward.9. Fixed CVE-2018-1160. Thanks to Steven Sroba.10. Fixed cfg_server security issue.

    Archived page, fetched 29 September 2026

Evidence

2 archived pages sit behind this record, the earliest read on 2 August 2026. Everything above was read from them, and each is kept byte for byte so it can be checked after the vendor edits the original.

Identifiers: marketing_name TUF-AX5400

Judged by lifecycle-1 on 30 September 2026. How these verdicts are computed.

Machine-readable: JSON · RSS