Asus have been notified but haven't even acknowledged yet alone mentioned a fix. If the inbuilt webserver is activated, anyone on the local network can get the full user/pass list from the router without any identification whatsoever by going to the ip address of the router and appending /userdata Example, say the ip address is 192.168.0.1, go to: http://192.168.0.1/userdata This will output the contents of the userdata file which contains completely unencrypted usernames and passwords. There are plenty of other files that can be access with this trick, I haven't looked at the content of them so I don't know what else you can do. This security flaw arises because the webserver on the router is mapped to index.html which provides a link to /secure/Home.htm You are not prompted for a password until you attempt to access files under /secure Telnet to the router, enter the user mode console and then type "flashfs" Type ls to see all configuration files accessible through this flaw.
