NewsCompaniesFlawsGuides
Get the app

CVE-2021-32030

From Exploited flaws, HARD’s guide to the flaws being used in attacks · Checked
This article is about a flaw in ASUS Routers. For every flaw being used in attacks, see Exploited flaws; for ASUS’s, see ASUS flaws being used in attacks.

CVE-2021-32030 is a security flaw in ASUS Routers, routers for homes and small offices. Attackers can get into ASUS Routers without a valid password. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its catalog of flaws known to be used in attacks on 2 Jun 2025.[1]

ASUS Routers is in things households have: home and small-office routers, so the fix matters at home as much as at work. ASUS has published a fix or advice.

Description

CISA calls it an improper authentication in ASUS Routers. In its words: “ASUS Lyra Mini and ASUS GT-AC2900 devices contain an improper authentication vulnerability that allows an attacker to gain unauthorized access to the administrative interface. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.”[1]

The CVE record adds: “The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.”[2]

The underlying weakness is improper authentication (CWE-287), in MITRE’s list of common software weaknesses.

It scores 9.8 out of 10 on the Common Vulnerability Scoring System, which rates it critical, scored by NVD using CVSS 3.1.[2]

Affected versions

NVD’s record doesn’t list version ranges for it; ASUS’s advisory has them[3]. CISA names the product as ASUS Routers.

Every device with ASUS Routers needs the update.

Exploitation

CISA added it to its catalog of known exploited vulnerabilities on 2 Jun 2025, 1,488 days after it was made public. CISA lists a flaw only when it has reliable evidence of it being exploited, and gave US federal agencies until 23 Jun 2025 to fix it.[1]

FIRST’s Exploit Prediction Scoring System, which estimates how likely a flaw is to be used in attacks in the next 30 days from what it sees across the internet, puts it at 99%. That’s in the top 1% of the flaws it scores.[4]

CISA assesses it as automatable: attackers can run it against many targets at once.

CISA doesn’t say who was attacked, or how.

Fix

ASUS has published a fix or advice.[3] CISA’s required action: “Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.”[1]

  1. Update ASUS Routers now.Open the router’s app, or its admin page in a browser, and look for a firmware update. Then turn on automatic updates, so the next fix arrives on its own.
  2. If the maker has stopped updating it, replace it.Routers stop getting fixes after a few years, and attackers keep a list of the ones that did. If there’s no newer firmware, it won’t be fixed.

Timeline

DateEvent
The flaw is made public in the National Vulnerability Database, with a severity score of 9.8.[2]
CISA adds it to its catalog of flaws known to be used in attacks.[1]
CISA’s deadline for US government agencies to fix it.[1]
FIRST puts the odds of it being used in attacks in the next 30 days at 99%.[4]

See also

Other ASUS flaws

  • CVE-2025-59374, ASUS Live Update: embedded malicious code ·
  • CVE-2023-39780, ASUS RT-AX55 Routers: OS command injection ·

Other improper authentication flaws

Added the same day

  • CVE-2025-3935, ConnectWise ScreenConnect: improper authentication ·
  • CVE-2025-35939, Craft CMS: external control of assumed-immutable web parameter ·
  • CVE-2024-56145, Craft CMS: code injection ·
  • CVE-2023-39780, ASUS RT-AX55 Routers: OS command injection ·

Every ASUS flaw on CISA’s list · Everything added in June 2025

References

  1. ^ Cybersecurity and Infrastructure Security Agency. “ASUS Routers Improper Authentication Vulnerability”. Known Exploited Vulnerabilities Catalog, added 2 Jun 2025.
  2. ^ National Institute of Standards and Technology. “CVE-2021-32030 Detail”. National Vulnerability Database, published 6 May 2021.
  3. ^ ASUS. Advisories and fixes: asus.com, asus.com.
  4. ^ FIRST. “Exploit Prediction Scoring System”. EPSS 0.994, percentile 99.9, 31 Oct 2026.
  5. CVE Program. “CVE-2021-32030”. The official CVE record.

This article is built from CISA’s catalog (version 2026.10.30), NVD’s record and FIRST’s scores, kept in HARD’s database and checked every morning. The plain English is HARD’s.