CVE-2021-41435

Vulnerability

The vulnerability resides in the CAPTCHA protection mechanism of the web interface on numerous ASUS router models. A remote attacker can bypass the brute-force protection by sending a specific HTTP request, allowing unlimited login attempts. Affected models include ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series (RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before firmware version 3.0.0.4.386.45898, and RT-AX68U before firmware version 3.0.0.4.386.45911 [1][2][3][4].

Exploitation

An attacker can exploit this vulnerability remotely without any authentication. By sending a specially crafted HTTP request, the attacker bypasses the CAPTCHA check and can perform an unlimited number of login attempts. This enables a brute-force attack on the router's admin credentials. No user interaction is required.

Impact

Successful exploitation allows an attacker to brute-force the admin password. If the password is guessed, the attacker gains full administrative access to the router, potentially leading to complete compromise of the device and the network it manages. This includes the ability to modify settings, intercept traffic, or launch further attacks.

Mitigation

ASUS has released firmware updates to fix this vulnerability. Users should upgrade to firmware version 3.0.0.4.386.45898 or later for most affected models, and version 3.0.0.4.386.45911 or later for RT-AX68U [1][2][3][4]. The updates are available on the ASUS support website. No workarounds are documented. This CVE is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.