CVE-2021-41435

A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U…

published November 19, 2021

CVSS
—
EPSS
6%
Percentile
93.7
In the wild
Unconfirmed
What it is

⚠️ An attacker can send a single HTTP request to bypass brute-force protections on multiple ASUS routers. It's like giving a thief unlimited chances to crack your safe by just asking for the combination! 🔓 Think of CAPTCHA as a security guard checking IDs at a club. If someone can sneak past that guard without a proper check, they can keep trying to get in over and over again, no matter how many times they fail. This vulnerability lets attackers do just that, repeatedly attempting logins without being stopped. If exploited, this flaw allows unauthorized access attempts, meaning an attacker could potentially break into your router or network. This could lead to data breaches, unauthorized changes to settings, or even turning your router into a part of a botnet! Yikes!

Put simply

Think of CAPTCHA as a security guard checking IDs at a club. If someone can sneak past that guard without a proper check, they can keep trying to get in over and over again, no matter how many times they fail. This vulnerability lets attackers do just that, repeatedly attempting logins without being stopped. This vulnerability allows remote attackers to bypass CAPTCHA protections by sending a specific HTTP request to vulnerable ASUS routers, enabling unlimited login attempts.

What to do

If exploited, this flaw allows unauthorized access attempts, meaning an attacker could potentially break into your router or network. This could lead to data breaches, unauthorized changes to settings, or even turning your router into a part of a botnet! Yikes! Immediately update your router firmware to version 3.0.0.4.386.45898 or later to close this security gap. Regularly review your router settings and consider changing passwords to enhance your security posture. 🛡️ You’ve got this! By following these steps, you’ll strengthen your network's defenses and get back to gaming in no time! 🎮✨

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06491 · 93.7th percentile
Published
2021-11-19T11:26Z
EPSS history
Timeline
  • 19 NOV 11:26Z
    A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U…
    cvelistv5