# CVE-2021-32030: ASUS GT-AC2900 - Authentication Bypass

> Live exploitation tracking for CVE-2021-32030 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-32030

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** ASUS GT-AC2900, ASUS Lyra Mini
- **Weaknesses:** CWE-287 (Improper Authentication)
- **Tags:** firewall

## Description

The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.

## CrowdSec analysis

[CVE-2021-32030](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-32030) is a critical vulnerability impacting certain ASUS router models, where improper authentication validation in the administrator application can enable unauthorized access to the device’s management interface.

CrowdSec has been tracking this vulnerability and its exploits since 16th of May 2024.

CrowdSec network observations suggest that most exploitation of CVE-2021-32030 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2021-32030. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Exploitation attempts have been detected targeting URLs containing `/appget.cgi?hook=get_cfg_clientlist()`.

## Timeline

- 2021-05-06: CVE Published. CVE-2021-32030 is published to NVD.
- 2024-05-16: Rule Released. CrowdSec releases a rule to detect CVE-2021-32030 exploitation attempts against the CrowdSec Network.
- 2024-11-24: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-32030 for the first time.
- 2025-06-02: CISA KEV. CVE-2021-32030 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2025-06-23: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0010.md
- https://www.atredis.com/blog/2021/4/30/asus-authentication-bypass
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32030.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-32030) follows observed exploitation activity for CVE-2021-32030. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.