CVE-2021-32030: ASUS Routers Improper Authentication Vulnerability

What it is

The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.

Exploitation evidence

First exploit evidence seen: 2025-06-02 (earliest date across the sources below).

Exploited in the wild

• CISA KEV: listed since 2025-06-02. Source

Sources: CISA KEV.

How to fix it

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (source: CISA KEV)

Fixed versions

• asus lyra mini firmware: upgrade to 3.0.0.4.384.46630 or later
• asus gt-ac2900 firmware: upgrade to 3.0.0.4.386.42643 or later

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

• https://www.asus.com/us/supportonly/lyra%20mini/helpdesk_bios/ (CISA KEV notes)
• https://www.asus.com/us/supportonly/rog%20rapture%20gt-ac2900/helpdesk_bios/ (CISA KEV notes)

MITRE ATT&CK mitigations for this chain

• M1030 Network Segmentation (for T1098, T1040) : Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.
• M1042 Disable or Remove Feature or Program (for T1098) : Remove unnecessary and potentially abusable authentication and authorization mechanisms where possible.
• M1018 User Account Management (for T1098, T1040) : Ensure that low-privileged user accounts do not have permissions to modify accounts or account-related policies.
• M1022 Restrict File and Directory Permissions (for T1098) : Restrict access to potentially sensitive files that deal with authentication and/or authorization.
• M1032 Multi-factor Authentication (for T1098, T1040) : Use multi-factor authentication for user and privileged accounts.
• M1026 Privileged Account Management (for T1098) : Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.
• M1028 Operating System Configuration (for T1098) : Protect domain controllers by ensuring proper security configuration for critical servers to limit access by potentially unnecessary protocols and services, such as SMB file sharing.
• M1051 Update Software (for T1068) : Update software regularly by employing patch management for internal enterprise endpoints and servers.
• M1050 Exploit Protection (for T1068) : Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. Control flow integrity checking is another way to potentially identify and stop a software exploi
• M1048 Application Isolation and Sandboxing (for T1068) : Make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities by using sandboxing. Other types of virtualization and application microsegmentation may also mitigate the impact of some types of exploitation. Risks of additional exploits and weaknesses in t

Detection Generic guidance

• Persistence: Look for new files in web roots, new scheduled tasks/services, and new accounts created after the exposure window.
• Privilege Escalation: Alert on processes gaining SYSTEM/root unexpectedly, and on exploitation crashes of privileged services.
• Credential Access: Monitor for credential dumping, unusual LSASS access and sudden authentication from new sources.
• Discovery: Look for directory listing, file enumeration and reconnaissance commands from service accounts.

Response checklist Generic guidance

1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.