CVE-2021-32030
ASUS Routers Improper Authentication Vulnerability
Description
CVE-2021-32030 is a critical authentication bypass vulnerability in ASUS GT-AC2900 and Lyra Mini routers that allows unauthenticated remote attackers to gain full administrative access to the router's web interface. The flaw exists in the HTTP request handling logic, where an attacker-supplied null byte ('\0') matches the device's default authentication token value, completely bypassing the authentication check. With a CVSS v3.1 score of 9.8 (CRITICAL), no authentication or user interaction required, and an EPSS score of 94.22% at the 99.92nd percentile indicating near-certain exploitation, CVE-2021-32030 poses an extreme risk to any exposed ASUS router running vulnerable firmware.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| asus | lyra mini firmware | < 3.0.0.4.384.46630 |
| asus | gt-ac2900 firmware | < 3.0.0.4.386.42643 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0010.md(Broken Link, Exploit, Third Party Advisory)
- https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-Gaming-Routers/RT-AC2900/HelpDesk_BIOS/(Product)
- https://www.asus.com/us/supportonly/lyra%20mini/helpdesk_bios/(Product)
- https://www.atredis.com/blog/2021/4/30/asus-authentication-bypass(Exploit)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-32030(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
CVE-2021-32030 is classified under CWE-287 (Improper Authentication), which occurs when a product does not sufficiently verify that a claimed identity is correct. In the ASUS router firmware, the authentication logic in the handle_request function of router/httpd/httpd.c and the auth_check function in web_hook.o compares an attacker-supplied authentication token against the device's stored value. Because the default stored value is a null byte ('\0'), an attacker who supplies a matching null byte passes the authentication check, gaining full administrative access without valid credentials.
Learn more: CWE-287 — Improper Authentication
Impact Analysis
CVE-2021-32030 represents one of the most severe vulnerability profiles possible, with maximum impact across all dimensions. The attack is network-accessible (AV:N) with low complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N)—meaning any attacker with network access to the router's web interface can exploit it trivially. Confidentiality (High): Full administrative access exposes all router configuration data including WiFi credentials, VPN configurations, connected device information, DNS settings, and network topology. Integrity (High): An attacker can modify any router setting, change DNS servers to redirect traffic through malicious infrastructure, update firmware with backdoored versions, create persistent administrative accounts, and configure port forwarding to expose internal network services. Availability (High): The attacker can disable the router, modify firewall rules, or brick the device through malicious firmware updates. The EPSS score of 94.22% at the 99.92nd percentile indicates near-certain exploitation activity, making this one of the most actively targeted router vulnerabilities.
Exploit Maturity
CVE-2021-32030 exhibits extremely high exploit maturity with near-certain exploitation activity. Public exploit code is available through the Atredis Partners advisory and detailed technical writeup at GitHub, providing step-by-step exploitation instructions. CISA has confirmed active exploitation by adding the vulnerability to the Known Exploited Vulnerabilities catalog. The EPSS score of 94.22% at the 99.92nd percentile places this vulnerability in the top 0.08% of all CVEs by exploitation probability, indicating massive, ongoing exploitation campaigns. The trivial nature of the exploit—simply sending a null byte as the authentication token—makes it accessible to even unsophisticated attackers using basic tools.
Remediation
-
Update firmware immediately. For ASUS GT-AC2900, upgrade to firmware version 3.0.0.4.386.42643 or later. For ASUS Lyra Mini, upgrade to firmware version 3.0.0.4_384_46630 or later. Note that older Lyra Mini devices that have reached end-of-life may not receive patches.
-
Disable remote administration (WAN access) on all affected ASUS routers immediately as a critical mitigation. This prevents exploitation from the internet and limits the attack surface to the local network. Navigate to the router's administration settings and ensure remote management is disabled.
-
Audit router configurations for signs of compromise. Check for unauthorized administrative accounts, modified DNS settings, unexpected port forwarding rules, changed firewall configurations, and any unknown firmware versions. Reset the router to factory defaults and reconfigure from scratch if compromise is suspected.
-
Replace end-of-life devices that cannot receive firmware updates. All versions of Lyra Mini and earlier models classified as unsupported (EOL) are permanently vulnerable and should be decommissioned.
-
Implement network segmentation to isolate router management interfaces from general network traffic. Use VLANs and firewall rules to restrict access to the router's administrative interface to authorized management stations only.
Technical Details
CVE-2021-32030 is an authentication bypass vulnerability in ASUS GT-AC2900 and Lyra Mini router firmware. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects the trivial, unauthenticated, remote exploitability of this flaw. The vulnerability exists in the HTTP daemon's authentication handling, specifically in the handle_request function in router/httpd/httpd.c and the auth_check function in web_hook.o. When a remote user sends an HTTP request to the router's web interface, the authentication module compares the user-supplied token against the stored authentication value. The critical flaw is that the device's default authentication token is a null byte ('\0'), and when the attacker supplies a matching null byte value, the string comparison succeeds, granting full administrative access. This represents a fundamental design flaw where the authentication system uses an easily guessable default value that matches trivially manipulable input, effectively rendering authentication non-existent for devices that retain the default token state.
Frequently Asked Questions
Is CVE-2021-32030 being actively exploited?
Yes. CVE-2021-32030 is confirmed actively exploited according to CISA's KEV catalog. The EPSS score of 94.22% at the 99.92nd percentile indicates near-certain exploitation. Public exploit code is freely available, making this accessible to attackers of any skill level.
What products are affected by CVE-2021-32030?
ASUS GT-AC2900 devices running firmware before version 3.0.0.4.386.42643 and ASUS Lyra Mini devices running firmware before version 3.0.0.4_384_46630 are affected. All end-of-life Lyra Mini models and earlier unsupported ASUS router models are also vulnerable.
How do I fix CVE-2021-32030?
Update the router firmware to the patched versions immediately. Disable remote WAN access as a critical interim mitigation. If the device is end-of-life and cannot receive updates, it should be replaced with a supported model.
How severe is CVE-2021-32030?
CVE-2021-32030 has the maximum practical severity with a CVSS score of 9.8 (CRITICAL). It requires no authentication and no user interaction to exploit remotely. The EPSS score of 94.22% confirms near-certain exploitation, making immediate action essential.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.