LiveActive security incident?Get immediate response
CVE Record

CVE-2021-45757: ASUS AC68U <=3.0.0.4.385.20852 is affected by a buffer overflow in blocking.cgi, which may cause a denial o...

ASUS AC68U <=3.0.0.4.385.20852 is affected by a buffer overflow in blocking.cgi, which may cause a denial of service (DoS).

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-45757 is a reported buffer overflow in ASUS AC68U firmware up to 3.0.0.4.385.20852. The stated impact is denial of service, meaning a vulnerable router could crash or become unavailable. The public record does not provide CVSS, authentication requirements, or a confirmed vendor fix.

Executive priority

Treat this as a targeted infrastructure hygiene issue, not an emergency without more evidence. Prioritize internet-exposed or business-critical ASUS AC68U routers because denial of service could disrupt connectivity or administration.

Technical view

The CVE describes a buffer overflow in blocking.cgi on ASUS AC68U firmware versions <=3.0.0.4.385.20852. The only stated security impact is DoS. The source bundle does not identify CWE, CPEs, required privileges, attack vector, affected configuration, or remediation version.

Likely exposure

Organizations may be exposed if they still operate ASUS AC68U routers on firmware 3.0.0.4.385.20852 or older. Exposure depends on whether the vulnerable management function is reachable; the sources do not state whether authentication or local network access is required.

Exploitation context

The CVE is not listed as KEV in the provided bundle, and no cited source states active exploitation. Public details are sparse, with a GitHub reference and CVE metadata describing the issue but not confirming exploitation in the wild.

Researcher notes

Evidence is limited to the CVE description and a GitHub reference. Do not assume code execution, unauthenticated reachability, or a patched version from the supplied data. Useful follow-up is vendor advisory correlation, firmware diffing, and exposure validation without testing production routers destructively.

Mitigation direction

  • Inventory ASUS AC68U devices and record firmware versions.
  • Check ASUS guidance for fixed firmware or official mitigations.
  • Upgrade vulnerable firmware if ASUS provides a newer supported release.
  • Restrict router management access to trusted administrative networks.
  • Disable unnecessary remote administration exposure where operationally possible.

Validation and detection

  • Confirm whether any ASUS AC68U runs firmware <=3.0.0.4.385.20852.
  • Review external exposure of router administration interfaces.
  • Check network logs for unexplained router crashes or management service restarts.
  • Verify firmware update status against ASUS-published guidance.
  • Document compensating controls when updates are unavailable.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-45757 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
2Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.