CVE-2021-3128
In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware < 3.0.0.4.386...
In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware < 3.0.0.4.386.42095 or < 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware < 3.0.0.4.386.42095 or < 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set.
- Record
CVE-2021-3128- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-834
- Updated
- 2026-11-02
CVE List No score
In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware < 3.0.0.4.386.42095 or < 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set.
- Record
CVE-2021-3128- Updated
- 2026-11-02
EUVDEUVD-2021-26477 No score
In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware < 3.0.0.4.386.42095 or < 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set.
- Record
EUVD-2021-26477- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-289v-jmv7-6xmx No score
In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware < 3.0.0.4.386...
In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware < 3.0.0.4.386.42095 or < 9.0.0.4.386.41994, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set.
- Record
GHSA-289v-jmv7-6xmx- Weakness
- CWE-834
- Updated
- 2026-11-02
Affected products
- asus rt-ac1750 b1 firmware
- asus rt-ac1900 firmware
- asus rt-ac1900p firmware
- asus rt-ac1900u firmware
- asus rt-ac2900 firmware
- asus rt-ac3100 firmware
- asus rt-ac5300 firmware
- asus rt-ac58u firmware
- asus rt-ac65u firmware
- asus rt-ac66u b1 firmware
- asus rt-ac68p firmware
- asus rt-ac68r firmware
Show 15 moreShow less
- asus rt-ac68rw firmware
- asus rt-ac68u firmware
- asus rt-ac68w firmware
- asus rt-ac85u firmware
- asus rt-ac86u firmware
- asus rt-ac88u firmware
- asus rt-ax3000 firmware
- asus rt-ax55 firmware
- asus rt-ax56u firmware
- asus rt-ax58u firmware
- asus rt-ax68u firmware
- asus rt-ax82u firmware
- asus rt-ax86u firmware
- asus rt-ax88u firmware
- asus zenwifi ax \(xt8\) firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-3128 is a high vulnerability (CVSS 7.5) in Asus Rt-ac1750 B1 Firmware, published April 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 16.2%, the 96th percentile. No source names a fixed version.
References
asus.com/Networking-IoT-Servers/WiFi-6/All-series/RT-AX3000/HelpDesk_BIOS
Show 23 moreShow less
nvd.nist.gov/vuln/detail/CVE-2021-3128
github.com/advisories/GHSA-289v-jmv7-6xmx