CVE-2021-41435
high-risk
Published 2021-11-19
A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote attacker to attempt any number of login attempts via sending a specific HTTP request.
Do I need to act?
~
2.5% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10
Critical
NETWORK
/ LOW complexity
Affected Products (18)
Gt-Ax11000 Firmware
Rt-Ax3000 Firmware
Rt-Ax55 Firmware
Rt-Ax56U Firmware
Rt-Ax56U V2 Firmware
Rt-Ax58U Firmware
Rt-Ax82U Firmware
Rt-Ax82U Gundam Edition Firmware
Rt-Ax86U Firmware
Rt-Ax86S Firmware
Rt-Ax86U Zaku Ii Edition Firmware
Rt-Ax88U Firmware
Rt-Ax92U Firmware
Tuf Gaming Ax3000 Firmware
Tuf-Ax5400 Firmware
Zenwifi Xd6 Firmware
Zenwifi Ax \(Xt8\) Firmware
Rt-Ax68U Firmware
Affected Vendors
References (16)
Vendor Advisory
http://asus.com
Vendor Advisory
http://asus.com
57
/ 100
high-risk
Severity
32/34 · Critical
Exploitability
6/34 · Minimal
Exposure
19/34 · Moderate