Coverage › CVE-2021-32030

CVE-2021-32030 Mapped Sigma

ASUS Routers Improper Authentication Vulnerability

Vendor / product

ASUS — Routers

Description (CISA)

ASUS Lyra Mini and ASUS GT-AC2900 devices contain an improper authentication vulnerability that allows an attacker to gain unauthorized access to the administrative interface. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Added to KEV

2025-06-02

Due date

2025-06-23

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known ransomware use

Unknown

CWE

CWE-287

CISA notes

https://www.asus.com/us/supportonly/lyra%20mini/helpdesk_bios/
https://www.asus.com/us/supportonly/rog%20rapture%20gt-ac2900/helpdesk_bios/
https://nvd.nist.gov/vuln/detail/CVE-2021-32030

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1040 Network Sniffing primary impact

• DET0314 Detection Strategy for Network Sniffing Across Platforms
  AN0875 Windows

  Detects suspicious execution of network monitoring tools (e.g., Wireshark, tshark, Microsoft Message Analyzer), driver loading indicative of promiscuous mode, or non-admin user privilege escalation to access NICs for capture.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:System EventCode=7045 → DC0060 Service Creation

  Tunable: ToolNames TimeWindow
  AN0876 Linux

  Correlates interface mode changes to promiscuous with execution of sniffing tools like tcpdump, tshark, or custom pcap libraries. Detects abnormal NIC configurations and unauthorized sniffing from non-root sessions.

  auditd:SYSCALL execve, setifflags → DC0032 Process Creation

  auditd:SYSCALL promiscuous mode transitions (ioctl or ifconfig) → DC0064 Command Execution

  networkconfig interface flag PROMISC, netstat | ip link | ethtool → DC0085 Network Traffic Content

  Tunable: InterfaceList PromiscuousSessionThreshold
  AN0877 macOS

  Detects enabling of interface sniffing via packet capture tools or AppleScript triggering tcpdump. Leverages Unified Logs and process lineage to identify suspicious use of pfctl, tcpdump, or libpcap libraries.

  macos:unifiedlog eventMessage = 'promiscuous' → DC0085 Network Traffic Content

  macos:osquery process_events where path like '%tcpdump%' → DC0032 Process Creation

  fs:fsusage access to BPF devices or interface IOCTLs → DC0064 Command Execution

  Tunable: AllowedTools UserContext
  AN0878 IaaS

  Detects creation of traffic mirroring sessions (e.g., AWS VPC Traffic Mirroring, Azure vTAP) that redirect traffic from critical assets to other virtual instances, often followed by file creation or session establishment.

  AWS:CloudTrail CreateTrafficMirrorSession / ModifyTrafficMirrorTarget → DC0069 Cloud Service Modification

  Tunable: MirrorSourceList TargetIAMRole
  AN0879 Network Devices

  Detects execution of capture commands via CLI (monitor capture, debug packet, etc.) or unauthorized CLI access followed by logging configuration changes on Cisco/Juniper/Arista gear.

  networkdevice:syslog admin login events → DC0002 User Account Authentication

  networkdevice:syslog exec command='monitor capture' → DC0064 Command Execution

  networkdevice:syslog config change (e.g., logging buffered, pcap buffers) → DC0085 Network Traffic Content

  Tunable: AdminSessionDuration CaptureCommandList

Sigma rules tagged attack.t1040 (9)

T1068 Exploitation for Privilege Escalation exploitation technique

• DET0514 Detection Strategy for Exploitation for Privilege Escalation
  AN1419 Windows

  Detects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.

  WinEventLog:Sysmon EventCode=6 → DC0079 Driver Load

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=4672 → DC0088 Logon Session Metadata

  Tunable: DriverNamePattern TimeWindow ParentProcessPath
  AN1420 Linux

  Detects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.

  auditd:SYSCALL execve → DC0032 Process Creation

  auditd:SYSCALL ACCESS → DC0035 Process Access

  auditd:SYSCALL dmesg → DC0016 Module Load

  Tunable: SetUIDBinaryList TimeWindow EffectiveUIDThreshold
  AN1421 macOS

  Detects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.

  macos:unifiedlog process:exec and kext load events → DC0032 Process Creation

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_KEXTLOAD → DC0016 Module Load

  Tunable: EntitlementList TimeWindow
  AN1422 Containers

  Detects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.

  auditd:SYSCALL capset or setns → DC0067 Logon Session Creation

  containerd:runtime e.g., containerd, Docker events → DC0091 Container Enumeration

  Tunable: NamespaceEscapePattern TimeWindow

Sigma rules tagged attack.t1068 (31)

All 31 rules on the technique page →

T1098 Account Manipulation primary impact

• DET0096 Account Manipulation Behavior Chain Detection
  AN0265 Windows

  Account attribute changes (e.g., password set, group membership, servicePrincipalName, logon hours) correlated with unusual process lineage or timing, indicating privilege escalation or persistence via valid accounts.

  WinEventLog:Security EventCode=4738, 4728, 4670 → DC0010 User Account Modification

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: TimeWindow HighPrivilegeGroupList SubjectTargetMismatch
  AN0266 Linux

  Use of native tools or scripting (e.g., usermod, passwd, groupmod) to escalate permissions or persist access on existing users, correlated with login or process events.

  auditd:SYSCALL usermod, groupmod, passwd → DC0010 User Account Modification

  auditd:PATH /etc/passwd or /etc/group file write → DC0061 File Modification

  Tunable: SudoPath ModifiedShellList
  AN0267 macOS

  Modifications to user accounts via dscl, pwpolicy, or System Preferences CLI (sysadminctl) that alter user groups, enable root, or bypass MDM restrictions.

  macos:unifiedlog com.apple.accountsd, com.apple.opendirectoryd → DC0010 User Account Modification

  Tunable: ModifiedUserList GroupMembershipChanges
  AN0268 Identity Provider

  Modifications to SSO/SAML user attributes (e.g., isAdmin, role, MFA bypass, App assignments) often through CLI, API, or rogue IdP apps.

  saas:okta User Attribute Modified / Role Assignment Changed → DC0010 User Account Modification

  Tunable: RoleAssignmentBaseline APIUsageContext
  AN0269 ESXi

  Addition of new users or changes to role permissions (e.g., ReadOnly -> Admin) via API or vSphere Client, particularly from non-jumpbox IPs.

  esxi:vpxa vim.SessionManager.login / vim.AccountManager.createUser → DC0066 Active Directory Object Modification

  Tunable: VMAdminAccountName NetworkAccessLocation
  AN0270 SaaS

  Role escalation (e.g., Editor → Owner) in cloud collaboration tools (Google Workspace, O365) or file sharing apps to maintain elevated access.

  m365:unified Admin Activity > Role Change or Sharing Change → DC0010 User Account Modification

  Tunable: SharingSensitivityLabel CrossOrgChanges

Sigma rules tagged attack.t1098 (34)

All 34 rules on the technique page →