What’s Vulnerable › Vulnerabilities
CVE-2021-41435
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 6.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-11-19 · updated 2026-07-09
- Weakness: CWE-307
Description
A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote attacker to attempt any number of login attempts via sending a specific HTTP request.
Affected products
- ASUS Gt-Ax11000 Firmware: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898
- ASUSTeK COMPUTER INC. ASUS Router RT-AX3000: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898
- ASUS RT-AX55: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898
- ASUS RT-AX56U: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898
- ASUS Rt-Ax56U V2 Firmware: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898
- ASUS Rt-Ax58U Firmware: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898
- ASUS Rt-Ax68U Firmware: before 3.0.0.4.386.45911 — fixed in 3.0.0.4.386.45911
- Asus RT-AX82U: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898
- ASUS Rt-Ax82U Gundam Edition Firmware: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898
- ASUS Rt-Ax86S Firmware: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898
- ASUS Rt-Ax86U Firmware: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898
- ASUS Rt-Ax86U Zaku Ii Edition Firmware: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898
- ASUS RT-AX88U: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898
- ASUS RT-AX92U: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898
- ASUS Tuf-Ax5400 Firmware: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898
- ASUS Tuf Gaming Ax3000 Firmware: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898
- ASUS Zenwifi Ax (Xt8) Firmware: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898
- ASUS Zenwifi Xd6 Firmware: before 3.0.0.4.386.45898 — fixed in 3.0.0.4.386.45898
How to fix
Upgrade to a fixed version: ASUS Gt-Ax11000 Firmware 3.0.0.4.386.45898; ASUSTeK COMPUTER INC. ASUS Router RT-AX3000 3.0.0.4.386.45898; ASUS RT-AX55 3.0.0.4.386.45898; ASUS RT-AX56U 3.0.0.4.386.45898; ASUS Rt-Ax56U V2 Firmware 3.0.0.4.386.45898; ASUS Rt-Ax58U Firmware 3.0.0.4.386.45898; ASUS Rt-Ax68U Firmware 3.0.0.4.386.45911; Asus RT-AX82U 3.0.0.4.386.45898; ASUS Rt-Ax82U Gundam Edition Firmware 3.0.0.4.386.45898; ASUS Rt-Ax86S Firmware 3.0.0.4.386.45898; ASUS Rt-Ax86U Firmware 3.0.0.4.386.45898; ASUS Rt-Ax86U Zaku Ii Edition Firmware 3.0.0.4.386.45898. Check the vendor advisory for mitigations.
References
- https://rog.asus.com/networking/rog-rapture-gt-ax11000-model/helpdesk_bios
- https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/
- https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-XD6/HelpDesk_BIOS/
- https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX3000/HelpDesk_BIOS/
- https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/
- https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX68U/HelpDesk_BIOS/
- https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/All-series/RT-AX55/HelpDesk_BIOS/
- https://rog.asus.com/networking/rog-rapture-gt-ax11000-model/helpdesk_bios
- https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-AX-XT8-/HelpDesk_BIOS/
- https://www.asus.com/Networking-IoT-Servers/Whole-Home-Mesh-WiFi-System/ZenWiFi-WiFi-Systems/ASUS-ZenWiFi-XD6/HelpDesk_BIOS/
- https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX3000/HelpDesk_BIOS/
- https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AX56U/HelpDesk_BIOS/
Get alerted when CVE-2021-41435 or the next vulnerability affects your stack