CVE-2021-32030: ASUS router admin interface authentication bypass via null byte

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, confirmed exploitation in CISA KEV, and near-certain EPSS probability make this an urgent edge-device risk.

What it is

ASUS GT-AC2900 and Lyra Mini routers fail to properly validate authentication input, allowing an unauthenticated remote user to bypass the administrator login. The flaw stems from an attacker-supplied '\0' value matching the device's default '\0' in handle_request and auth_check, granting access to the admin interface. It matters because these are internet-facing edge devices and the bypass is trivially reachable over the network.

Impact

An attacker gains full unauthorized access to the router's administrator interface, enabling configuration changes, traffic interception, and use of the device as a pivot into the internal network.

Attack surface

Reachable over the network via the router's remote management interface (AV:N, PR:N, UI:N); no authentication or user interaction is required. The vendor notes consumers can mitigate by disabling remote access features from WAN, implying exposure occurs when WAN-side administration is enabled.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2025-06-02, and EPSS shows a 30-day exploitation probability of 0.99393 (99.9th percentile). Public exploit references are tagged 'Exploit' by third parties, and no ransomware campaign use is documented.

What to do

• Apply the vendor firmware updates: GT-AC2900 to 3.0.0.4.386.42643 or later and Lyra Mini to 3.0.0.4_384_46630 or later.
• Disable remote access/administration from the WAN on all affected routers as an interim mitigation.
• Replace or retire Lyra Mini units that are end-of-life and cannot be patched.
• Restrict administrative access to the LAN and trusted management networks only.
• Follow CISA BOD 22-01 required action guidance and track the KEV due date of 2025-06-23.

Detection

• Monitor router and perimeter logs for unauthenticated or anomalous requests to the administrative interface, especially from WAN-side source addresses.
• Alert on successful admin logins or configuration changes originating from unexpected external IPs.
• Audit exposed management ports on ASUS routers and flag any WAN-reachable admin interface.
• Review firmware versions of GT-AC2900 and Lyra Mini devices against the fixed builds.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.