.. / CVE-2021-20090

Exploit for Buffalo WSR-2533DHPL2 - Path Traversal (CVE-2021-20090)

Description:

Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 are susceptible to a path traversal vulnerability that could allow unauthenticated remote attackers to bypass authentication in their web interfaces.

Nuclei Template

View the template here CVE-2021-20090.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-20090.yaml
Copy

References:

https://www.secpod.com/blog/arcadyan-based-routers-and-modems-under-active-exploitation/
https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2
https://www.tenable.com/security/research/tra-2021-13
https://nvd.nist.gov/vuln/detail/CVE-2021-20090
https://www.kb.cert.org/vuls/id/914124