{"answers":{"affected":"It affects 2 products.","exploited":"Yes. Attackers have exploited CVE-2021-32030 in the wild since at least 2 Jun 2025.","fix":"No fix has been published for CVE-2021-32030 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 23 Jun 2025.","what":"CVE-2021-32030 is a critical authentication bypass vulnerability in n/a, published on 6 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2021-32030 and fix it if it is affected.\n\nWhat it is: CVE-2021-32030 is a critical authentication bypass vulnerability in n/a, published on 6 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: Yes. Attackers have exploited CVE-2021-32030 in the wild since at least 2 Jun 2025.\n\nAffected product: n/a. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2021-32030/ (Markdown: https://insights.sbomify.com/CVE-2021-32030/index.md)","id":"CVE-2021-32030","markdown":"https://insights.sbomify.com/CVE-2021-32030/index.md","name":"CVE-2021-32030","record":{"aliases":["GHSA-mmm5-f82c-58j8"],"analysis":{"component_type":"network_device","fix_type":"upgrade","impacts":["privilege_escalation","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"ASUS router","requires_auth":"none","summary":"An unauthenticated attacker can bypass authentication to access the administrator interface on ASUS routers by exploiting a null byte comparison flaw.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"mitre","cpe":[{"product":"gt-ac2900_firmware","vendor":"asus"},{"product":"lyra_mini_firmware","vendor":"asus"}],"cvss":{"score":9.8,"severity":"critical","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"description":"The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\\0' matches the device's default value of '\\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":1,"refs":[{"date":null,"kind":"nuclei","ref":"http/cves/2021/CVE-2021-32030.yaml","stars":null,"title":"ASUS GT-AC2900 - Authentication Bypass"}],"tier":"exploited"},"has_fix":null,"headline":"ASUS Routers Improper Authentication","id":"CVE-2021-32030","indexable":true,"kev":{"dateAdded":"2025-06-02","dueDate":"2025-06-23","knownRansomwareCampaignUse":"Unknown","product":"Routers","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","vendorProject":"ASUS","vulnerabilityName":"ASUS Routers Improper Authentication Vulnerability"},"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"auth_bypass","year":"2021"},"n_packages":0,"n_references":4,"next":{"headline":"Memory corruption in n/a","id":"CVE-2021-32032"},"packages":[],"prev":{"headline":"Information disclosure in postgresql","id":"CVE-2021-32029"},"products":["n/a"],"published":"2021-05-06","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"open","licence":"CC0 1.0","name":"CISA KEV"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"attribution","licence":"MIT","name":"Nuclei templates"}],"ssvc":{"automatable":"yes","exploitation":"active","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-10-21","vendors":["n/a"]},"summary":"An unauthenticated attacker can bypass authentication to access the administrator interface on ASUS routers by exploiting a null byte comparison flaw.","url":"https://insights.sbomify.com/CVE-2021-32030/"}