CVE-2021-37910lowCWE-799

CVE-2021-37910: low-severity vulnerability in ASUS GT-AXE11000

ASUS GT-AXE11000, RT-AX3000, RT-AX55, RT-AX58U, TUF-AX3000 - Improper Authentication

Published · Updated

Follow this CVE+ Monitor RT-AX55+ Monitor RT-AX58U

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.7epss 2.1%
In short

ASUS routers with WPA2/WPA3 security have a weakness that lets attackers disconnect other users from Wi-Fi by sending specially crafted network messages, without needing to know the Wi-Fi password.

Technical detail

The vulnerability exists in the SAE (Simultaneous Authentication of Equals) authentication frame handling, where insufficient rate limiting on authentication attempts allows unauthenticated attackers to remotely trigger denial-of-service conditions by flooding the access point with malformed authentication frames, resulting in disconnection of legitimate clients.

Summary generated and translated by AI from the official description.
ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticated attacker can remotely disconnect other users' connections by sending specially crafted SAE authentication frames.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
ASUS · GT-AXE11000ASUS · RT-AX3000ASUS · RT-AX55ASUS · RT-AX58UASUS · TUF-AX3000
Related CVEs — ASUS GT-AXE11000

In the same product, most dangerous first.

CVE-2023-39780HIGHCVE-2023-39780EPSS 39.5%KEVCVE-2023-41348HIGHASUS RT-AX55 - command injection - 4EPSS 1.7%CVE-2023-41347HIGHASUS RT-AX55 - command injection - 3EPSS 1.7%CVE-2023-41345HIGHASUS RT-AX55 - command injection - 1EPSS 1.7%CVE-2023-41346HIGHASUS RT-AX55 - command injection - 2EPSS 1.6%CVE-2023-39238HIGHASUS RT-AX55、RT-AX56U_V2 - Format String - 1EPSS 1.4%