CVE-2021-32030

    Dashboard / Vulnerabilities / CVE-2021-32030

    CVE-2021-32030

    Published: 6 May 2021Last Modified: 10 Mar 2026

    Summary:

    Details: The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.

    References: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-32030, , https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-Gaming-Routers/RT-AC2900/HelpDesk_BIOS/, https://www.asus.com/us/supportonly/lyra%20mini/helpdesk_bios/, https://www.atredis.com/blog/2021/4/30/asus-authentication-bypass, https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0010.md

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-32030 | CVE-DB