CVE-2021-41435
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
A vulnerability in the firmware of multiple ASUS routers allows bypassing CAPTCHA protection against brute-force attacks. An attacker can send a specific HTTP request to perform unlimited login attempts.
Risk Assessment
The risk involves potential remote takeover of the admin account via brute force, leading to full device and network compromise.
Recommendation
Immediately update the router firmware to version 3.0.0.4.386.45898 or later (for listed models) and 3.0.0.4.386.45911 for RT-AX68U.
Original NVD description (English source)
A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote attacker to attempt any number of login attempts via sending a specific HTTP request.