I have an Asus AC87U, FW Version 3.0.0.4.380.7743 (1 release behind).
The latest release 3.0.0.4.382.50010 (2018-01-25) comes with lots of security fixes, including unspecified RCE vulnerabilities.
Security fixed
- Fixed KRACK vulnerability
- Fixed CVE-2017-14491: DNS - 2 byte heap based overflow
- Fixed CVE-2017-14492: DHCP - heap based overflow
- Fixed CVE-2017-14493: DHCP - stack based overflow
- Fixed CVE-2017-14494: DHCP - info leak
- Fixed CVE-2017-14495: DNS - OOM DoS
- Fixed CVE-2017-14496: DNS - DoS Integer underflow -Fixed CVE-2017-13704 : Bug collision
- Fixed predictable session tokens(CVE-2017-15654), logged user IP validation(CVE-2017-15653), Logged-in information disclosure (special thanks for Blazej Adamczyk contribution)
- Fixed web GUI authorization vulnerabilities.
- Fixed AiCloud XSS vulnerabilities
- Fixed XSS vulnerability. Thanks for Joaquim's contribution.
- Fixed LAN RCE vulnerability. An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program
- Fixed remote code execution vulnerability. Thanks to David Maciejak of Fortinet's FortiGuard Labs
- Fixed Smart Sync Stored XSS vulnerabilities. Thanks fo Guy Arazi's contribution. -Fixed CVE-2018-5721 Stack-based buffer overflow.
Although there don't seem to be public details available, attackers might have independently discovered or reverse-engineered some of the critical vulnerabilities patched in that release. Diffing different firmware releases to find out what parts were patched is usually quite straightforward, even without access to the original source.
Also, there might be a more recent attack going on. This tweet from three days ago seems to describe a very similar attack as you experienced:
My ASUS home router was apparently hacked and a rogue DNS server in Dubai added to the configuration. It redirected sites like http://apple.com to a phishing site that (I think) I caught before my children gave away their credentials. Check your routers kids.
@harlanbarnes on Twitter (2018-03-09)
No one has access to my router administration page aside from me on the network
Even if your router interface isn't visible from outside your network, it can be vulnerable to a range of attacks. As an example, take this Netgear router arbitrary code execution exploit from a while ago which had Netgear routers execute arbitrary commands sent in the URL. Since any website can issue a cross-domain request to any other website, the attack idea here is to trick you into visiting a prepared website that makes you conduct the attack yourself by issuing a specially crafted request to the router interface (essentially a CSRF attack on the intranet). This can be done by a background script on an untrusted website without you noticing.