Cyber Resilience

CVE-2021-3128

HighDDoS

Published: 12 April 2021

Published
12 April 2021
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0248 85.6th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-3128 is a high-severity Excessive Iteration (CWE-834) vulnerability in Asus Zenwifi Ax \(Xt8\) Firmware. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 14.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware < 3.0.0.4.386.42095 or < 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's…

more

router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set.

CWE(s)
CWE-834

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

asus
zenwifi ax \(xt8\) firmware
≤ 3.0.0.4.386.42095 · ≤ 9.0.0.4.386.41994
asus
rt-ax3000 firmware
≤ 3.0.0.4.386.42095 · ≤ 9.0.0.4.386.41994
asus
rt-ax55 firmware
≤ 3.0.0.4.386.42095 · ≤ 9.0.0.4.386.41994
asus
rt-ax56u firmware
≤ 3.0.0.4.386.42095 · ≤ 9.0.0.4.386.41994
asus
rt-ax58u firmware
≤ 3.0.0.4.386.42095 · ≤ 9.0.0.4.386.41994
asus
rt-ax68u firmware
≤ 3.0.0.4.386.42095 · ≤ 9.0.0.4.386.41994
asus
rt-ax82u firmware
≤ 3.0.0.4.386.42095 · ≤ 9.0.0.4.386.41994
asus
rt-ax86u firmware
≤ 3.0.0.4.386.42095 · ≤ 9.0.0.4.386.41994
asus
rt-ax88u firmware
≤ 3.0.0.4.386.42095 · ≤ 9.0.0.4.386.41994
asus
rt-ac66u b1 firmware
≤ 3.0.0.4.386.42095 · ≤ 9.0.0.4.386.41994
+17 more product configuration(s) — see NVD for full list

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References