CVE-2021-46825: Symantec Advanced Secure Gateway (ASG) and ProxySG are susceptible to an HTTP desync vulnerability. When a remote unauthenticated attacker and other web…

PriorityP357critical9.1CVSS 3.1

AVNACLPRNUINSUCHIHAN

EPSS

1.37%

68.6th percentile

Symantec Advanced Secure Gateway (ASG) and ProxySG are susceptible to an HTTP desync vulnerability. When a remote unauthenticated attacker and other web clients communicate through the proxy with the same web server, the attacker can send crafted HTTP requests and cause the proxy to forward web server responses to unintended clients. Severity/CVSSv3: High / 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected

4 ranges

Vendor	Product	Version range	Fixed in
broadcom	advanced_secure_gateway	—	—
broadcom	advanced_secure_gateway	—	—
broadcom	proxysg	—	—
broadcom	proxysg	—	—

CVSS provenance

nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.