CVE-2021-32030

Published May 6, 2021

Last updated a month ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2021-32030 is an authentication bypass vulnerability affecting ASUS GT-AC2900 devices before version 3.0.0.4.386.42643 and Lyra Mini devices before version 3.0.0.4_384_46630. The vulnerability stems from how the administrator application processes remote input from unauthenticated users. Specifically, the vulnerability allows an attacker to gain unauthorized access to the administrator interface. This is because an attacker-supplied null byte ('\0') can match the device's default null byte value in certain situations during the authentication process. Successful exploitation could allow attackers to modify router settings, intercept network traffic, and potentially install malicious firmware.

Description
The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.
Source
cve@mitre.org
NVD status
Analyzed

Risk scores

CVSS 3.1

Type
Primary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

CVSS 2.0

Type
Primary
Base score
7.5
Impact score
6.4
Exploitability score
10
Vector string
AV:N/AC:L/Au:N/C:P/I:P/A:P

Known exploits

Data from CISA

Vulnerability name
ASUS Routers Improper Authentication Vulnerability
Exploit added on
Jun 2, 2025
Exploit action due
Jun 23, 2025
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

nvd@nist.gov
CWE-287
134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-287

Social media

Hype score
Not currently trending

Configurations