CVE-2021-32030

The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.

• CWE-287
• CWE-287

• https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0010.mdBroken Link, Exploit, Third Party Advisory
• https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-Gaming-Routers/RT-AC2900/HelpDesk_BIOS/Product
• https://www.asus.com/us/supportonly/lyra%20mini/helpdesk_bios/Product
• https://www.atredis.com/blog/2021/4/30/asus-authentication-bypassExploit
• https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0010.mdBroken Link, Exploit, Third Party Advisory
• https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-Gaming-Routers/RT-AC2900/HelpDesk_BIOS/Product
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-32030US Government Resource

Published

May 6, 2021

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32023An elevation of privilege vulnerability in the message broke…7.8
• CVE-2021-32024A remote code execution vulnerability in the BMP image codec…9.8
• CVE-2021-32025An elevation of privilege vulnerability in the QNX Neutrino …7.8
• CVE-2021-32027A flaw was found in postgresql in versions before 13.3, befo…8.8
• CVE-2021-32028A flaw was found in postgresql. Using an INSERT ... ON CONFL…6.5
• CVE-2021-32029A flaw was found in postgresql. Using an UPDATE ... RETURNIN…6.5
• CVE-2021-32032In Trusted Firmware-M through 1.3.0, cleaning up the memory …7.5
• CVE-2021-32033Protectimus SLIM NFC 70 10.01 devices allow a Time Traveler …4.6
• CVE-2021-32036An authenticated user without any specific authorizations ma…7.1
• CVE-2021-32037An authorized user may trigger an invariant which may result…6.5
• CVE-2021-32039Users with appropriate file access may be able to access une…5.5
• CVE-2021-3204SSRF in the document conversion component of Webware Webdesk…6.5