Critical severity · published Nov 19, 2021
CVE-2021-41435
A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION,…
9.8
CVSS
6.5%
EPSS
No
On KEV
Description
A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote attacker to attempt any number of login attempts via sending a specific HTTP request.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.5% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GF
Gt-ax11000 Firmware · Asus
before 3.0.0.4.386.45898 · source: NVD
RF
Rt-ax3000 Firmware · Asus
before 3.0.0.4.386.45898 · source: NVD
RF
Rt-ax55 Firmware · Asus
before 3.0.0.4.386.45898 · source: NVD
RF
Rt-ax56u Firmware · Asus
before 3.0.0.4.386.45898 · source: NVD
RV
Rt-ax56u V2 Firmware · Asus
before 3.0.0.4.386.45898 · source: NVD
RF
Rt-ax58u Firmware · Asus
before 3.0.0.4.386.45898 · source: NVD
RF
Rt-ax68u Firmware · Asus
before 3.0.0.4.386.45911 · source: NVD
RF
Rt-ax82u Firmware · Asus
before 3.0.0.4.386.45898 · source: NVD
RG
Rt-ax82u Gundam Edition Firmware · Asus
before 3.0.0.4.386.45898; before 3.0.0.4.386.45898 · source: NVD
RF
Rt-ax86s Firmware · Asus
before 3.0.0.4.386.45898 · source: NVD
RF
Rt-ax86u Firmware · Asus
before 3.0.0.4.386.45898 · source: NVD
RZ
Rt-ax86u Zaku II Edition Firmware · Asus
before 3.0.0.4.386.45898 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-41435
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-41435
Product
https://rog.asus.com/networking/rog-rapture-gt-ax11000-model/helpdesk_bios
Product
https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/
Product
https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-XD6/HelpDesk_BIOS/
Product
https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX3000/HelpDesk_BIOS/
Product
https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/
Product
https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX68U/HelpDesk_BIOS/
More from Gt-ax11000 Firmware
9.8
CVE-2022-26376
A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7
7.5
CVE-2021-41436
An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86…