CVE-2021-32030
Description
The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations. Note: All versions of Lyra Mini and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability, Consumers can mitigate this vulnerability by disabling the remote access features from WAN.
Summary dbcve.org
Authentication bypass vulnerability in ASUS GT-AC2900 and Lyra Mini routers allows unauthenticated remote attackers to access the administrator interface. The flaw is in the auth_check function within the HTTP daemon (httpd.c and web_hook.o) where an attacker-supplied null byte value ('\0') incorrectly matches the device's default '\0' value, bypassing authentication checks.
Mitigation
Disable remote access features from WAN on affected devices to prevent unauthenticated attackers from reaching the administrator interface. If available, apply vendor firmware updates.