CVE-2021-20090
Arcadyan Buffalo Firmware Path Traversal Vulnerability
Description
CVE-2021-20090 is a critical-severity vulnerability affecting Arcadyan Buffalo Firmware. Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information. This vulnerability affects multiple routers across several different vendors. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 94.40% (100.0th percentile), this vulnerability has a high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| buffalo | wsr-2533dhpl2-bk firmware | <= 1.02 |
| buffalo | wsr-2533dhp3-bk firmware | <= 1.24 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.kb.cert.org/vuls/id/914124(Third Party Advisory, US Government Resource)
- https://www.secpod.com/blog/arcadyan-based-routers-and-modems-under-active-exploitation/(Exploit, Third Party Advisory)
- https://www.tenable.com/security/research/tra-2021-13(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20090(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
Path Traversal (CWE-22) is a vulnerability that allows attackers to access files and directories outside the intended directory structure by manipulating file path references, typically using sequences like "../". When present in web interfaces of network devices such as routers, path traversal can enable complete authentication bypass, giving attackers unauthorized access to sensitive device configurations and management functions.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
Impact Analysis
CVE-2021-20090 carries a CVSS 3.1 score of 9.8 (CRITICAL), indicating a maximum-severity threat. The vulnerability is exploitable over the network with low attack complexity, requires no authentication, without user interaction. Successful exploitation can severely compromise data confidentiality, allow unauthorized modification of data and systems, and cause complete service disruption. Organizations running affected deployments face significant operational risk if this vulnerability remains unpatched.
Exploit Maturity
CVE-2021-20090 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 94.40% (100.0th percentile) indicates a very high probability of exploitation. While not currently associated with known ransomware campaigns, the confirmed exploitation status demands immediate attention. Federal agencies were required to remediate this vulnerability by 2021-11-17 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions.
- Verify that all instances of affected products (buffalo wsr-2533dhpl2-bk firmware (<= 1.02), buffalo wsr-2533dhp3-bk firmware (<= 1.24)) have been updated to patched versions.
- If immediate patching is not possible, restrict network access to affected systems using firewall rules and network segmentation to limit exposure.
- Monitor systems for indicators of compromise, including unusual process activity, unexpected network connections, and unauthorized configuration changes.
- Review security logs and conduct threat hunting to determine if the vulnerability was exploited prior to patching.
Technical Details
CVE-2021-20090 affects Arcadyan Buffalo Firmware. A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication. The attack vector is network-based, meaning an attacker can exploit this vulnerability remotely without physical access to the target system. The CVSS score of 9.8 reflects the combination of low exploitability and severe impact across confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2021-20090 being actively exploited?
Yes. CVE-2021-20090 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 94.40% (100.0th percentile) further indicates a very high exploitation probability.
What products are affected by CVE-2021-20090?
CVE-2021-20090 affects Arcadyan Buffalo Firmware. Specifically affected products include: buffalo wsr-2533dhpl2-bk firmware (<= 1.02), buffalo wsr-2533dhp3-bk firmware (<= 1.24).
How do I fix CVE-2021-20090?
Apply updates per vendor instructions. Ensure all affected systems are updated to the latest patched versions. If patching is not immediately possible, implement network-level mitigations to limit exposure.
How severe is CVE-2021-20090?
CVE-2021-20090 has a CVSS 3.1 score of 9.8 (CRITICAL). This is a critical-severity vulnerability that requires immediate attention and remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.