CVE-2021-32030

What it actually does

CVE-2021-32030 is a network-reachable authentication bypass in the ASUS GT-AC2900 administrator web application. The flaw occurs in request authentication handling, where an attacker-controlled null byte value can match an expected default null value under certain conditions, causing the device to treat an unauthenticated request as authorized. Successful exploitation can provide unauthorized access to the router’s administrator interface, enabling configuration changes, credential exposure, traffic redirection, service disruption, or further device compromise. The CVSS 9.8 rating reflects that exploitation is remote, low complexity, requires no credentials, requires no user interaction, and can fully compromise confidentiality, integrity, and availability of the device.

Why it matters to the business

Compromise of an edge router can give attackers control over internet connectivity and network traffic for homes, branches, or small offices using affected ASUS GT-AC2900 devices. Attackers may change DNS settings, expose internal services, intercept or redirect traffic, disable security controls, create persistence, or use the router as part of a botnet or pivot point. This vulnerability is listed in CISA KEV with a remediation due date of 2025-06-23 and has a very high EPSS score, indicating strong evidence of real-world exploitation likelihood and urgency for remediation. While not specifically marked as ransomware-associated, compromised routers can still support intrusion operations by enabling traffic manipulation, credential theft, or stealthy access into downstream networks.

How an attack unfolds

An attacker scans the internet or a target network for exposed ASUS GT-AC2900 administrator interfaces. After identifying a reachable management service, the attacker sends crafted unauthenticated HTTP requests containing a null byte value in an input field processed by the router’s authentication logic. Because the supplied value can match the device’s default null value in vulnerable firmware, the authentication check may incorrectly succeed. The attacker then reaches administrator-only functionality without valid credentials. From there, they can modify router configuration, change DNS or firewall rules, enable remote access, add or alter administrative settings, reboot the device, disrupt service, or position the router for follow-on activity such as traffic interception, proxying, botnet enrollment, or pivoting toward internal systems.

How to fix it

Upgrade ASUS GT-AC2900 firmware to version 3.0.0.4.386.42643 or later. If the device is already end-of-life or cannot be updated to a fixed firmware release, replace it with a supported model. Disable remote administration from the internet unless absolutely required, and restrict management access to trusted internal networks or a dedicated administrative VPN. Change administrator credentials after patching, especially if the device may have been exposed before remediation. Review and reset DNS, port forwarding, firewall, VPN, DDNS, and remote access settings to known-good values. Reboot the router after firmware update and configuration review. Where possible, place router management interfaces behind network controls that block unauthenticated external access.

How to confirm the fix worked

Confirm the installed firmware version on each ASUS GT-AC2900 device is 3.0.0.4.386.42643 or later. Verify that the administrator interface is not reachable from the public internet unless explicitly required and protected by strong network controls. Attempt access to administrative pages from an unauthenticated session and confirm that authentication is required. Review router configuration for unauthorized DNS servers, unexpected port-forwarding rules, enabled WAN administration, unknown VPN or DDNS settings, and unexpected administrator credential changes. Use external attack-surface scanning to verify no exposed vulnerable management interface remains. If firmware cannot be upgraded, validate that compensating controls block all untrusted access to the management service.

Typical attack path

1. Identify ASUS GT-AC2900 devices through internet-wide scanning, banner analysis, web interface fingerprinting, or local network discovery.
2. Confirm that the router administrator interface is reachable from the attacker’s network path.
3. Send crafted unauthenticated HTTP requests containing a null byte value designed to trigger the authentication bypass condition.
4. Gain access to administrator-only web interface functionality without valid credentials.
5. Modify router settings such as DNS, firewall, port forwarding, VPN, remote administration, or user/admin configuration.
6. Establish persistence or operational utility by enabling management access, changing credentials, adding services, or enrolling the device into attacker infrastructure.
7. Use the compromised router to intercept, redirect, proxy, disrupt, or pivot network traffic.

How to detect it

Investigate router administration logs, web access logs if available, configuration change history, DNS settings, firewall and port-forwarding rules, VPN and DDNS configuration, and WAN remote-administration status. Look for unauthenticated or unusual requests to administrative endpoints, especially requests containing URL-encoded null bytes or malformed authentication-related parameters. Review timestamps for configuration changes made before expected administrator logins or from unfamiliar source IP addresses. Check for unexpected DNS resolver changes, new port forwards, enabled WAN management, altered administrator credentials, unexpected VPN profiles, unknown DDNS hostnames, repeated reboot events, or outbound connections to unfamiliar infrastructure. Because many consumer routers have limited logging, absence of evidence is not reliable; if the device was internet-exposed and running vulnerable firmware, consider factory reset, credential rotation, and full configuration rebuild. For network telemetry, search proxy, firewall, IDS, and packet captures for HTTP requests to the router management interface containing null byte encodings or suspicious unauthenticated access attempts.

• %00
• \x00
• %2500
• GET /
• POST /
• httpd
• router/httpd/httpd.c
• web_hook.o
• auth_check
• handle_request
• 3.0.0.4.386.42643
• WAN remote administration enabled
• Remote Administration
• Enable Web Access from WAN
• unexpected DNS server
• unexpected port forwarding rule
• unknown DDNS hostname
• ASUS GT-AC2900

What your security team should do

• Treat affected ASUS GT-AC2900 routers as high priority because the vulnerability is remotely exploitable without authentication, has active exploitation evidence, appears in CISA KEV, and has a very high EPSS score.
• Inventory ASUS GT-AC2900 devices and verify firmware versions, prioritizing any device with internet-exposed administration enabled.
• Upgrade to firmware version 3.0.0.4.386.42643 or later, or replace unsupported devices.
• Disable WAN-side remote administration and restrict router management to trusted internal networks or VPN-only access.
• After remediation, rotate router administrator credentials and review all network-facing configuration for unauthorized changes.
• Reset suspicious devices to factory defaults, reapply known-good configuration, and then update firmware if compromise is suspected.
• Monitor edge-device logs, DNS settings, outbound connections, and configuration changes for signs of prior exploitation.
• Use external scanning and firewall policy review to ensure router management interfaces are not exposed to untrusted networks.
• Track CISA KEV timelines and ensure remediation is completed no later than the listed 2025-06-23 deadline where applicable.