U.S. CISA adds ASUS RT-AX55 devices, Craft CMS, and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities catalog
60
CVE-2021-32030
ASUS Routers Improper Authentication Vulnerability
- CVSS 3.1
- 9.8 critical
- EPSS
- 99%p100
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2021-32030 is an improper authentication vulnerability (CWE-287) in ASUS Lyra Mini and ASUS GT-AC2900 routers that allows an attacker to gain unauthorized access to the administrative interface. It was added to the CISA Known Exploited Vulnerabilities catalog on 2025-06-02 and has an EPSS of 99.4% (100th percentile), indicating a very high probability of exploitation within 30 days. Because the affected devices may be end-of-life or end-of-service, CISA advises discontinuing their use if mitigations are unavailable.
What to do: Apply mitigations per ASUS vendor instructions and follow applicable BOD 22-01 guidance for cloud services; if mitigations are unavailable, discontinue use of the affected devices per CISA's required action. In the interim, restrict exposure of the routers' administrative interfaces to trusted networks only.
Description · NVD
The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.
KEVCISA Known Exploited Vulnerability
- Affected
- ASUS Routers
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Due date
- Ransomware use
- Unknown
- Vendors
- asus
- Products
- lyra mini firmware, gt-ac2900 firmware
- Weakness
- CWE-287
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
2 stories60