CVE-2021-41436: asus gt-ax11000_firmware HTTP Request/Response Smuggling

Vulnerability summary

CVE-2021-41436 is a high (CVSS 7.8) HTTP Request/Response Smuggling vulnerability in asus gt-ax11000_firmware. EPSS estimates a 4.95% chance of exploitation in the next 30 days, higher than 92% of scored vulnerabilities.

Timeline

1. 19-11-2021
   PublishedVulnerability first disclosed.
2. 09-07-2026
   Last modifiedVulnerability information updated.

Description

An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote unauthenticated attacker to DoS via sending a specially crafted HTTP packet.

• CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.