A few years ago my mother had some problems with her internet, she had recently changed her old D-LINK to a brand new flagship ASUS router. So while visiting her I played around with web interface and not many minutes in I managed to gain RCE allowing me to access a full root shell on the router via HTTP and I were even able to fetch the shadow-file. I searched the web and found several similar flaws,

Ever since whenever someone I know is about to buy an ASUS router I make sure to warn them and tell them to at least making sure to run the latest firmware if they go through with the purchase. As for my mother I brought over an old C2D-box which I hooked up with a couple of old Intel Pro Server GBE-nics, configured a NetBSD firewall+nat and reconfigured her router to act as a* dumb access point.

*Should I use an here since the object it is acting upon is started with a vowel or should I let the adjective rule the indefinite article? English isn't my first nor second language and I always struggle with these things so I appreciate any guidance.