CVE-2021-20090criticalunder attackCWE-22

CVE-2021-20090: critical vulnerability in Buffalo WSR-2533DHPL2, Buffalo WSR-2533DHP3

Published · Updated

Follow this CVE+ Monitor WSR-2533DHP3+ Monitor WSR-2533DHPL2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

95Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon
Published on NVDApr 29
CISA KEV+188d
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

An unauthenticated attacker can bypass login protections on Buffalo routers by manipulating file paths in requests, gaining unauthorized access to the device's web interface without needing valid credentials.

Technical detail

A path traversal vulnerability (CWE-22) in Buffalo WSR-2533DHPL2 (≤1.02) and WSR-2533DHP3 (≤1.24) web interfaces permits unauthenticated remote attackers to bypass authentication mechanisms by crafting malicious path sequences, enabling unauthorized access to administrative functions.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Buffalo WSR-2533DHPL2, Buffalo WSR-2533DHP3