A post on Slashdot says that Merlin patched the CVS in March. Merlin also patched the EOLed RT-AX56U, which Asus isn't providing an updated firmware for.