Arcadyan Buffalo Firmware Path Traversal Vulnerability

CRITICO 9.8EXPLOITED (CISA KEV)CVE-2021-20090 · Published 29/04/2021 · updated 17/06/2026

Arcadyan Buffalo Firmware Path Traversal Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

In breve

CVE-2021-20090 è una vulnerabilità CRITICO (CVSS 9.8).
Sfruttata attivamente: la CISA l'ha aggiunta al catalogo KEV il 03/11/2021.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 100.0%, superiore al 100.0% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
Buffalo Firmware Arcadyan	Versions not published yet (product named by CISA KEV)

Description

A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication.

References

kb.cert.org/vuls/id/914124 · Third Party Advisory
secpod.com/blog/arcadyan-based-routers-and-modems-under-active-exploitation · Exploit
tenable.com/security/research/tra-2021-13 · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2021-20090

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free