{"id":"CVE-2021-41437","aliases":["EUVD-2021-28464","GHSA-69p6-xm96-58f8"],"status":"published","title":"An HTTP response splitting attack in web application in ASUS RT-AX88U before v3.0.0.4.388.20558...","description":"An HTTP response splitting attack in web application in ASUS RT-AX88U before v3.0.0.4.388.20558 allows an attacker to craft a specific URL that if an authenticated victim visits it, the URL will give access to the cloud storage of the attacker.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0112,"percentile":0.66584,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-436","CWE-74"],"published":"2022-09-26T13:18:38Z","modified":"2026-06-17T04:08:31Z","products":[{"vendor":"asus","product":"rt-ax88u_firmware"}],"references":[{"url":"https://github.com/efchatz/easy-exploits/tree/main/Web/ASUS/CVE-2021-41437","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory"]},{"url":"https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-Gaming-Routers/RT-AX88U/HelpDesk_BIOS/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Product","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41437"},{"url":"https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-Gaming-Routers/RT-AX88U/HelpDesk_BIOS"},{"url":"https://github.com/advisories/GHSA-69p6-xm96-58f8"}],"sources":{"cve":[{"id":"CVE-2021-41437","description":"An HTTP response splitting attack in web application in ASUS RT-AX88U before v3.0.0.4.388.20558 allows an attacker to craft a specific URL that if an authenticated victim visits it, the URL will give access to the cloud storage of the attacker.","status":"published","published":"2022-09-26T13:18:38Z","modified":"2025-05-21T18:37:09.543Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:32:59.430294Z"}],"euvd":[{"id":"EUVD-2021-28464","description":"An HTTP response splitting attack in web application in ASUS RT-AX88U before v3.0.0.4.388.20558 allows an attacker to craft a specific URL that if an authenticated victim visits it, the URL will give access to the cloud storage of the attacker.","status":"published","published":"2022-09-26T13:18:38Z","modified":"2025-05-21T18:37:09Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:41.053396Z"}],"ghsa":[{"id":"GHSA-69p6-xm96-58f8","title":"An HTTP response splitting attack in web application in ASUS RT-AX88U before v3.0.0.4.388.20558...","description":"An HTTP response splitting attack in web application in ASUS RT-AX88U before v3.0.0.4.388.20558 allows an attacker to craft a specific URL that if an authenticated victim visits it, the URL will give access to the cloud storage of the attacker.","status":"published","published":"2022-09-27T00:00:21Z","modified":"2025-05-21T21:32:08Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-74","CWE-436"],"updated_at":"2026-11-02T15:02:24.130786Z"}],"nvd":[{"id":"CVE-2021-41437","description":"An HTTP response splitting attack in web application in ASUS RT-AX88U before v3.0.0.4.388.20558 allows an attacker to craft a specific URL that if an authenticated victim visits it, the URL will give access to the cloud storage of the attacker.","status":"published","published":"2022-09-26T14:15:09.627Z","modified":"2026-06-17T04:08:31.01Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:07:06.906968Z"}]}}