CVE-2021-32030 ASUS Routers Improper Authentication
An unauthenticated attacker can bypass authentication to access the administrator interface on ASUS routers by exploiting a null byte comparison flaw.
- Exploited in the wild
- Since 2 Jun 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-32030?
CVE-2021-32030 is a critical authentication bypass vulnerability in n/a, published on 6 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.
Weakness: CWE-287
Which versions are affected by CVE-2021-32030?
It affects 2 products.
Products include Asus Gt-Ac2900 Firmware, Asus Lyra Mini Firmware.
How do I fix CVE-2021-32030?
No fix has been published for CVE-2021-32030 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 23 Jun 2025.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-32030 being exploited?
Yes. Attackers have exploited CVE-2021-32030 in the wild since at least 2 Jun 2025.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-mmm5-f82c-58j8.