CVE-2021-32030
📋 TL;DR
This vulnerability allows unauthenticated attackers to bypass authentication on ASUS GT-AC2900 and Lyra Mini routers by sending specially crafted input with null bytes. This grants unauthorized access to the administrator interface, potentially leading to complete device compromise. All users of affected ASUS router models with vulnerable firmware versions are impacted.
💻 Affected Systems
- ASUS GT-AC2900
- ASUS Lyra Mini
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router takeover allowing attacker to reconfigure network settings, intercept traffic, install malware, pivot to internal network devices, and maintain persistent access.
Likely Case
Unauthorized access to router admin panel enabling network configuration changes, DNS hijacking, credential theft, and potential lateral movement to connected devices.
If Mitigated
Limited impact if remote access features are disabled and proper network segmentation prevents router exposure to untrusted networks.
🎯 Exploit Status
Exploit involves sending authentication requests with null byte values that bypass auth_check function. Public proof-of-concept available in advisory references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: GT-AC2900: 3.0.0.4.386.42643 or later; Lyra Mini: 3.0.0.4_384_46630 or later
Vendor Advisory: https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-Gaming-Routers/RT-AC2900/HelpDesk_BIOS/
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to Firmware Upgrade section. 3. Download latest firmware from ASUS support site. 4. Upload and install firmware. 5. Reboot router after installation completes.
🔧 Temporary Workarounds
Disable Remote Access
allDisable WAN/remote management features to prevent external exploitation
Login to router admin -> Advanced Settings -> Administration -> System -> Disable 'Enable Web Access from WAN'
Network Segmentation
allPlace router on isolated network segment with strict firewall rules
Configure firewall to block external access to router admin ports (typically 80, 443, 8443)
🧯 If You Can't Patch
- Immediately disable all remote access/WAN management features in router settings
- Implement network-level controls to restrict access to router admin interface from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Information or Firmware Version sectionCheck Version:
Login to router admin panel and navigate to System Status or Firmware Information pageVerify Fix Applied:
Confirm firmware version matches or exceeds patched versions: GT-AC2900 >= 3.0.0.4.386.42643, Lyra Mini >= 3.0.0.4_384_46630📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access to admin URLs
- Authentication bypass attempts with unusual parameters
- Multiple failed login attempts followed by successful admin access
Network Indicators:
- External IP addresses accessing router admin interface
- Unusual traffic patterns to router management ports from internet
SIEM Query:
source_ip=external AND (dest_port=80 OR dest_port=443 OR dest_port=8443) AND (url_path CONTAINS "/login.cgi" OR url_path CONTAINS "/apply.cgi") AND response_code=200🔗 References
- https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0010.md
- https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-Gaming-Routers/RT-AC2900/HelpDesk_BIOS/
- https://www.asus.com/us/supportonly/lyra%20mini/helpdesk_bios/
- https://www.atredis.com/blog/2021/4/30/asus-authentication-bypass
- https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0010.md
- https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-Gaming-Routers/RT-AC2900/HelpDesk_BIOS/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-32030
