CVE-2021-41436
high-risk
Published 2021-11-19
An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote unauthenticated attacker to DoS via sending a specially crafted HTTP packet.
Do I need to act?
~
4.6% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10
High
NETWORK
/ LOW complexity
Affected Products (18)
Gt-Ax11000 Firmware
Rt-Ax3000 Firmware
Rt-Ax55 Firmware
Rt-Ax56U Firmware
Rt-Ax56U V2 Firmware
Rt-Ax58U Firmware
Rt-Ax82U Firmware
Rt-Ax82U Gundam Edition Firmware
Rt-Ax86U Firmware
Rt-Ax86S Firmware
Rt-Ax86U Zaku Ii Edition Firmware
Rt-Ax88U Firmware
Rt-Ax92U Firmware
Tuf Gaming Ax3000 Firmware
Tuf-Ax5400 Firmware
Zenwifi Xd6 Firmware
Zenwifi Ax \(Xt8\) Firmware
Rt-Ax68U Firmware
Affected Vendors
References (16)
Vendor Advisory
http://asus.com
Vendor Advisory
http://asus.com
53
/ 100
high-risk
Severity
26/34 · High
Exploitability
8/34 · Low
Exposure
19/34 · Moderate