Arcadyan Buffalo Firmware Path Traversal Vulnerability

KRITISCH 9.8EXPLOITED (CISA KEV)CVE-2021-20090 · Published 29/04/2021 · updated 17/06/2026

Arcadyan Buffalo Firmware Path Traversal Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

Kurz gesagt

CVE-2021-20090 ist eine Schwachstelle (KRITISCH (CVSS 9.8)).
Wird aktiv ausgenutzt: CISA hat sie am 03/11/2021 in den KEV-Katalog aufgenommen.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 100.0%, höher als bei 100.0% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
Buffalo Firmware Arcadyan	Versions not published yet (product named by CISA KEV)

Description

A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication.

References

kb.cert.org/vuls/id/914124 · Third Party Advisory
secpod.com/blog/arcadyan-based-routers-and-modems-under-active-exploitation · Exploit
tenable.com/security/research/tra-2021-13 · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2021-20090

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free