CVE-2021-41435
Critical
Description
A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote attacker to attempt any number of login attempts via sending a specific HTTP request.
SeverityCritical
CVSS9.8
Exploit probability—
ProductAsus Gt-ax11000 Firmware
PublishedNov 19, 2021
First seenNov 19, 2021
How to fix
Update
- asus gt-ax11000_firmware3.0.0.4.386.45898 or later
- asus rt-ax3000_firmware3.0.0.4.386.45898 or later
- asus rt-ax55_firmware3.0.0.4.386.45898 or later
- asus rt-ax56u_firmware3.0.0.4.386.45898 or later
- asus rt-ax56u_v2_firmware3.0.0.4.386.45898 or later
- asus rt-ax58u_firmware3.0.0.4.386.45898 or later
- asus rt-ax82u_firmware3.0.0.4.386.45898 or later
- asus rt-ax82u_gundam_edition_firmware3.0.0.4.386.45898 or later
- asus rt-ax86u_firmware3.0.0.4.386.45898 or later
- asus rt-ax86s_firmware3.0.0.4.386.45898 or later
- asus rt-ax86u_zaku_ii_edition_firmware3.0.0.4.386.45898 or later
- asus rt-ax88u_firmware3.0.0.4.386.45898 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| asus gt-ax11000_firmware | v < 3.0.0.4.386.45898 | 3.0.0.4.386.45898 |
| asus rt-ax3000_firmware | v < 3.0.0.4.386.45898 | 3.0.0.4.386.45898 |
| asus rt-ax55_firmware | v < 3.0.0.4.386.45898 | 3.0.0.4.386.45898 |
| asus rt-ax56u_firmware | v < 3.0.0.4.386.45898 | 3.0.0.4.386.45898 |
| asus rt-ax56u_v2_firmware | v < 3.0.0.4.386.45898 | 3.0.0.4.386.45898 |
| asus rt-ax58u_firmware | v < 3.0.0.4.386.45898 | 3.0.0.4.386.45898 |
| asus rt-ax82u_firmware | v < 3.0.0.4.386.45898 | 3.0.0.4.386.45898 |
| asus rt-ax82u_gundam_edition_firmware | v < 3.0.0.4.386.45898 | 3.0.0.4.386.45898 |
| asus rt-ax86u_firmware | v < 3.0.0.4.386.45898 | 3.0.0.4.386.45898 |
| asus rt-ax86s_firmware | v < 3.0.0.4.386.45898 | 3.0.0.4.386.45898 |
| asus rt-ax86u_zaku_ii_edition_firmware | v < 3.0.0.4.386.45898 | 3.0.0.4.386.45898 |
| asus rt-ax88u_firmware | v < 3.0.0.4.386.45898 | 3.0.0.4.386.45898 |
| asus rt-ax92u_firmware | v < 3.0.0.4.386.45898 | 3.0.0.4.386.45898 |
| asus tuf_gaming_ax3000_firmware | v < 3.0.0.4.386.45898 | 3.0.0.4.386.45898 |
| asus tuf-ax5400_firmware | v < 3.0.0.4.386.45898 | 3.0.0.4.386.45898 |
| asus zenwifi_xd6_firmware | v < 3.0.0.4.386.45898 | 3.0.0.4.386.45898 |
| asus zenwifi_ax_\(xt8\)_firmware | v < 3.0.0.4.386.45898 | 3.0.0.4.386.45898 |
| asus rt-ax68u_firmware | v < 3.0.0.4.386.45911 | 3.0.0.4.386.45911 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.