CVE-2021-41435 Security feature bypass in n/a
Remote attackers can bypass CAPTCHA protection to perform unlimited login attempts on vulnerable ASUS routers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-41435?
CVE-2021-41435 is a critical vulnerability in n/a, published on 19 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote attacker to attempt any number of login attempts via sending a specific HTTP request.
Weakness: CWE-307
Which versions are affected by CVE-2021-41435?
It affects 18 products.
Products include Asus Gt-Ax11000 Firmware, Asus Rt-Ax3000 Firmware, Asus Rt-Ax55 Firmware, Asus Rt-Ax56u Firmware, Asus Rt-Ax56u V2 Firmware, Asus Rt-Ax58u Firmware and 12 more.
How do I fix CVE-2021-41435?
No fix has been published for CVE-2021-41435 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-41435 being exploited?
There is no known exploitation of CVE-2021-41435 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-hjq5-v65p-2p24.