ASUS GT-AC2900 - Authentication Bypass (CVE-2021-32030)
Description
The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.
psychologyCrowdSec Analysis
CVE-2021-32030 is a critical vulnerability impacting certain ASUS router models, where improper authentication validation in the administrator application can enable unauthorized access to the device’s management interface.
CrowdSec has been tracking this vulnerability and its exploits since 16th of May 2024.
CrowdSec network observations suggest that most exploitation of CVE-2021-32030 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2021-32030. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.
Exploitation attempts have been detected targeting URLs containing /appget.cgi?hook=get_cfg_clientlist().
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2021-05-06 |
| Rule Released | 2024-05-16 |
| CrowdSec First Seen | 2024-11-24 |
| CISA KEV | 2025-06-02 |
| CISA Remediation Deadline | 2025-06-23 |