Vulnerability · Published Nov 12, 2021 · Assigned by twcert
CVE-2021-37910ASUS GT-AXE11000, RT-AX3000, RT-AX55, RT-AX58U, TUF-AX3000 - Improper Authentication
Low 3.7
In plain English
A low-severity security flaw in GT-AXE11000 from ASUS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)2.1%top 18.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticated attacker can remotely disconnect other users' connections by sending specially crafted SAE authentication frames.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ASUS | GT-AXE11000 | unspecified – before 3.0.0.4.386.45898 |
| ASUS | RT-AX3000 | unspecified – before 3.0.0.4.386.45898 |
| ASUS | RT-AX55 | unspecified – before 3.0.0.4.386.45898 |
| ASUS | RT-AX58U | unspecified – before 3.0.0.4.386.45898 |
| ASUS | TUF-AX3000 | unspecified – before 3.0.0.4.386.45898 |
Weakness: CWE-799 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://www.twcert.org.tw/tw/cp-132-5259-22a26-1.html x_refsource_MISC