Which products and versions are affected by CVE-2021-32030?

Affected: Gt-Ac2900 Firmware (Asus); Lyra Mini Firmware (Asus). The full list is in the CVE brief.

Is CVE-2021-32030 being exploited in the wild?

It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Oct 14, 2023.

Is CVE-2021-32030 in the CISA KEV catalog?

Yes. It was added on Jun 2, 2025 with a federal remediation due date of Jun 23, 2025.

Is there a public exploit for CVE-2021-32030?

Public exploit code is available.

Is there a fix for CVE-2021-32030?

Fixed versions are available, including Gt-Ac2900 Firmware 3.0.0.4.386.42643, Lyra Mini Firmware 3.0.0.4.384.46630.

How urgently should CVE-2021-32030 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Request A Demo

Vulnerability Intelligence

CVE-2021-32030

CriticalExploitedPublic exploit

Published May 6, 2021 · Updated Nov 10, 2025

Key Facts

Patch immediately

CVE-2021-32030 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Gt-Ac2900 Firmware (Asus), Lyra Mini Firmware (Asus).
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Oct 14, 2023. Public exploit code is available.
EPSS estimates a 99% probability of exploitation in the next 30 days.
Fixed versions are available, including Gt-Ac2900 Firmware 3.0.0.4.386.42643, Lyra Mini Firmware 3.0.0.4.384.46630.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

99%

Higher than 99.9% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2021-32030 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.

Known-Exploited Catalog Listings

Catalog	Added	Remediation due	Ransomware use
CISA KEV	Jun 2, 2025	Jun 23, 2025	Not reported
Industry KEV feed	Nov 16, 2023	Jun 23, 2025	Not reported
CIRCL KEV	Oct 14, 2023	Jun 23, 2025	Not reported
ENISA EUVD	Jun 2, 2025	n/a	Not reported

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected Products

2 affected entries in total

Product	Affected versions	Fixed in
Gt-Ac2900 FirmwareAsus	See advisory	3.0.0.4.386.42643
Lyra Mini FirmwareAsus	See advisory	3.0.0.4.384.46630

Patched Releases

Gt-Ac2900 Firmware

3.0.0.4.386.42643

Lyra Mini Firmware

3.0.0.4.384.46630

Timeline

Publicly disclosed
May 6, 2021
Added to CIRCL KEV
Oct 14, 2023
Added to Industry KEV feed
Nov 16, 2023
Added to CISA KEV
Jun 2, 2025
Added to ENISA EUVD
Jun 2, 2025
Last updated
Nov 10, 2025

Weakness Type

CWE-287 Improper Authentication

References

9 more references in the full CVE brief

FAQ

Common Questions.

The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface.
Affected: Gt-Ac2900 Firmware (Asus); Lyra Mini Firmware (Asus). The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Oct 14, 2023.
Yes. It was added on Jun 2, 2025 with a federal remediation due date of Jun 23, 2025.
Public exploit code is available.
Fixed versions are available, including Gt-Ac2900 Firmware 3.0.0.4.386.42643, Lyra Mini Firmware 3.0.0.4.384.46630.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Is CVE-2021-32030 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.