← Back to browse · API

CVE-2021-41435

Severity
CRITICAL
CVSS
9.8
EPSS
0.05994
Risk score
41.3
CISA KEV
No
PoC
No
Published
2021-11-19
Modified
2026-07-09
First seen
2026-08-05
Aliases
EUVD-2021-28462, GHSA-HJQ5-V65P-2P24
Products
asus:gt-ax11000, asus:gt-ax11000_firmware, asus:rt-ax3000, asus:rt-ax3000_firmware, asus:rt-ax55, asus:rt-ax55_firmware, asus:rt-ax56u, asus:rt-ax56u_firmware, asus:rt-ax56u_v2, asus:rt-ax56u_v2_firmware, asus:rt-ax58u, asus:rt-ax58u_firmware, asus:rt-ax68u, asus:rt-ax68u_firmware, asus:rt-ax82u, asus:rt-ax82u_firmware, asus:rt-ax82u_gundam_edition, asus:rt-ax82u_gundam_edition_firmware, asus:rt-ax86s, asus:rt-ax86s_firmware, asus:rt-ax86u, asus:rt-ax86u_firmware, asus:rt-ax86u_zaku_ii_edition, asus:rt-ax86u_zaku_ii_edition_firmware, asus:rt-ax88u, asus:rt-ax88u_firmware, asus:rt-ax92u, asus:rt-ax92u_firmware, asus:tuf-ax5400, asus:tuf-ax5400_firmware, asus:tuf_gaming_ax3000, asus:tuf_gaming_ax3000_firmware, asus:zenwifi_ax_\(xt8\), asus:zenwifi_ax_\(xt8\)_firmware, asus:zenwifi_xd6, asus:zenwifi_xd6_firmware, n/a:n/a n/a
Sources
nvd CVE-2021-41435
euvd EUVD-2021-28462

Description

A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote attacker to attempt any number of login attempts via sending a specific HTTP request.

References