CVE-2021-37910: ASUS GT-AXE11000, RT-AX3000, RT-AX55, RT-AX58U, TUF-AX3000 - Improper Authentication

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-12 · updated 2026-06-17
Weakness: CWE-799

Description

ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticated attacker can remotely disconnect other users' connections by sending specially crafted SAE authentication frames.

Affected products

ASUS Gt-Axe11000 Firmware: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898
ASUSTeK COMPUTER INC. ASUS Router RT-AX3000: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898
ASUS RT-AX55: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898
ASUS Rt-Ax58U Firmware: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898
ASUS Tuf-Ax3000 Firmware: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898

How to fix

Upgrade to a fixed version: ASUS Gt-Axe11000 Firmware 3.0.0.4.386.45898; ASUSTeK COMPUTER INC. ASUS Router RT-AX3000 3.0.0.4.386.45898; ASUS RT-AX55 3.0.0.4.386.45898; ASUS Rt-Ax58U Firmware 3.0.0.4.386.45898; ASUS Tuf-Ax3000 Firmware 3.0.0.4.386.45898. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-37910 or the next vulnerability affects your stack