CVE-2021-32030
ASUS Routers Improper Authentication Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 23 June 2025). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 99.39% probability · 100th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Listed 2 June 2025 · due 23 June 2025
- Weakness
- CWE-287
- Affected
- asus/lyra mini firmware · asus/gt-ac2900 firmware
- Source
- cve@mitre.org
EPSS 99.4% since 26 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
CISA notes
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://www.asus.com/us/supportonly/lyra%20mini/helpdesk_bios/ ; https://www.asus.com/us/supportonly/rog%20rapture%20gt-ac2900/helpdesk_bios/; https://nvd.nist.gov/vuln/detail/CVE-2021-32030
References
- https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0010.mdBroken Link, Exploit, Third Party Advisory
- https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-Gaming-Routers/RT-AC2900/HelpDesk_BIOS/Product
- https://www.asus.com/us/supportonly/lyra%20mini/helpdesk_bios/Product
- https://www.atredis.com/blog/2021/4/30/asus-authentication-bypassExploit
- https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0010.mdBroken Link, Exploit, Third Party Advisory
- https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-Gaming-Routers/RT-AC2900/HelpDesk_BIOS/Product
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-32030US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.