CVE-2021-41436

HighCVSS 7.5

Published: 19/11/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

4.57%

90th percentile - higher than 90% of all known CVEs

Summary

An HTTP request smuggling vulnerability in the web application of multiple ASUS routers allows a remote unauthenticated attacker to cause a DoS by sending a specially crafted HTTP packet.

Risk Assessment

An attacker can cause device unavailability (DoS), disrupting network operations and services for end users.

Recommendation

Immediately update the router firmware to version 3.0.0.4.386.45898 or later (for listed models) and to 3.0.0.4.386.45911 for RT-AX68U.

Original NVD description (English source)

An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, ASUS ZenWiFi AX (XT8) before 3.0.0.4.386.45898, and RT-AX68U before 3.0.0.4.386.45911, allows a remote unauthenticated attacker to DoS via sending a specially crafted HTTP packet.