CVE-2021-41436

Vulnerability

An HTTP request smuggling vulnerability exists in the web application component of multiple ASUS router models, including the ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series (RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-AX88U, RT-AX92U, TUF Gaming AX3000, TUF Gaming AX5400 (TUF-AX5400), ASUS ZenWiFi XD6, and ASUS ZenWiFi AX (XT8) devices running firmware versions prior to 3.0.0.4.386.45898, and the RT-AX68U prior to 3.0.0.4.386.45911 [1][2][3][4]. The flaw allows an attacker to smuggle HTTP requests by sending a specially crafted packet that the server interprets differently than the intended proxy or backend, disrupting normal HTTP processing.

Exploitation

A remote, unauthenticated attacker can exploit this vulnerability by sending a single specially crafted HTTP packet to the affected router's web interface [1][2][3][4]. No prior authentication or special network position is required; the attacker only needs network connectivity to the router's management interface. The crafted packet manipulates the HTTP request parsing to cause the server to misinterpret the request boundaries, leading to a denial of service condition.

Impact

Successful exploitation allows an unauthenticated remote attacker to cause a denial of service (DoS) condition on the affected router [1][2][3][4]. The attacker disrupts the normal operation of the web application, potentially making the router's management interface unavailable. The vulnerability does not directly lead to code execution or data disclosure, but the DoS can prevent legitimate users from accessing router configuration and monitoring features.

Mitigation

The vulnerability is fixed in firmware version 3.0.0.4.386.45898 for most affected models, and version 3.0.0.4.386.45911 for the RT-AX68U [1][2][3][4]. Users should update their router firmware to the latest available version from ASUS's official support pages. No workarounds have been publicly disclosed for unpatched devices. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.