{"id":"CVE-2021-32030","aliases":["EUVD-2021-18896","GHSA-mmm5-f82c-58j8"],"status":"published","title":"The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 allows...","description":"The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\\0' matches the device's default value of '\\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.99393,"percentile":0.9994,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2021-05-06T14:54:31Z","modified":"2026-06-17T03:52:42Z","kev":{"date_added":"2025-06-02","due_date":"2025-06-23","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2025-06-02"},{"source":"kev","since":"2025-06-02"}],"exploits":[{"source":"nuclei","id":"CVE-2021-32030","title":"ASUS GT-AC2900 - Authentication Bypass","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32030.yaml"}],"products":[{"vendor":"asus","product":"gt-ac2900_firmware"},{"vendor":"asus","product":"lyra_mini_firmware"},{"vendor":"asus","product":"routers"}],"references":[{"url":"https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-Gaming-Routers/RT-AC2900/HelpDesk_BIOS/","tags":["x_refsource_MISC","x_transferred","Product"]},{"url":"https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0010.md","tags":["x_refsource_MISC","x_transferred","Broken Link","Exploit","Third Party Advisory"]},{"url":"https://www.atredis.com/blog/2021/4/30/asus-authentication-bypass","tags":["Exploit"]},{"url":"https://www.asus.com/us/supportonly/lyra%20mini/helpdesk_bios/","tags":["Product"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-32030","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32030"},{"url":"https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-Gaming-Routers/RT-AC2900/HelpDesk_BIOS"},{"url":"https://www.asus.com/us/supportonly/lyra%20mini/helpdesk_bios"},{"url":"https://github.com/advisories/GHSA-mmm5-f82c-58j8"}],"sources":{"cve":[{"id":"CVE-2021-32030","description":"The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\\0' matches the device's default value of '\\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.","status":"published","published":"2021-05-06T14:54:31Z","modified":"2025-10-21T23:25:47.016Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:33:07.014772Z"}],"euvd":[{"id":"EUVD-2021-18896","description":"The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\\0' matches the device's default value of '\\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.","status":"published","published":"2021-05-06T14:54:31Z","modified":"2025-10-21T23:25:47Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2025-06-02","updated_at":"2026-11-02T20:31:25.308373Z"}],"ghsa":[{"id":"GHSA-mmm5-f82c-58j8","title":"The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 allows...","description":"The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\\0' matches the device's default value of '\\0' in some situations.","status":"published","published":"2022-05-24T19:01:29Z","modified":"2025-10-22T00:33:09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:04:07.67458Z"}],"kev":[{"id":"CVE-2021-32030","title":"ASUS Routers Improper Authentication Vulnerability","description":"ASUS Lyra Mini and ASUS GT-AC2900 devices contain an improper authentication vulnerability that allows an attacker to gain unauthorized access to the administrative interface. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","cwes":["CWE-287"],"kev":{"date_added":"2025-06-02","due_date":"2025-06-23","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2021-32030","description":"The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\\0' matches the device's default value of '\\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.","status":"published","published":"2021-05-06T15:15:07.973Z","modified":"2026-06-17T03:52:42.307Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:06:52.81233Z"}]}}