CVE-2021-20090

🗓️ 29 Apr 2021 00:00:00Reported by tenableType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 1397 Views🌐 WEB

A path traversal vulnerability in Buffalo WSR-2533DHPL2 and WSR-2533DHP3 firmware versions <= 1.02 and <= 1.24 allows remote attackers to bypass authentication

Reporter	Title	Published	Views	Family All 46
zdt	HughesNet HT2000W Satellite Modem - Password Reset Exploit	27 Aug 202400:00	–	zdt
ICS	Top CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors	6 Oct 202212:00	–	ics
attackerkb	CVE-2021-20090	29 Apr 202100:00	–	attackerkb
attackerkb	CVE-2021-22506	26 Mar 202100:00	–	attackerkb
attackerkb	CVE-2021-1497	5 May 202100:00	–	attackerkb
attackerkb	CVE-2020-29557	29 Jan 202100:00	–	attackerkb
attackerkb	CVE-2021-1498	5 May 202100:00	–	attackerkb
Information Security Automation	Joint Advisory AA22-279A and Vulristics	21 Oct 202220:10	–	avleonov
BDU FSTEC	-based Arcadyan Routers Authentication Bypass	10 Aug 202100:00	–	bdu_fstec
Tenable Nessus	Buffalo Router Path Traversal (CVE-2021-20090)	9 Nov 202100:00	–	nessus

NVD

Vulners

Node

AND

buffalo wsr-2533dhpl2-bk_firmwareRange≤1.02

buffalo wsr-2533dhpl2-bkMatch-

Node

AND

buffalo wsr-2533dhp3-bk_firmwareRange≤1.24

buffalo wsr-2533dhp3-bkMatch-

[
  {
    "vendor": "n/a",
    "product": "Buffalo WSR-2533DHPL2, Buffalo WSR-2533DHP3",
    "versions": [
      {
        "version": "WSR-2533DHPL2 <=1.02, WSR-2533DHP3 <= 1.24",
        "status": "affected"
      }
    ]
  }
]

Source	Link
kb	www.kb.cert.org/vuls/id/914124
tenable	www.tenable.com/security/research/tra-2021-13
secpod	www.secpod.com/blog/arcadyan-based-routers-and-modems-under-active-exploitation/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
httoken	path	/images/..%2fapply_abstract.cgi	Path traversal to apply_abstract.cgi to change administrator password (password reset).	CWE-22
action	path	/images/..%2fapply_abstract.cgi	Path traversal to apply_abstract.cgi to change administrator password (password reset).	CWE-22
submit_button	path	/images/..%2fapply_abstract.cgi	Path traversal to apply_abstract.cgi to change administrator password (password reset).	CWE-22
ARC_SYS_Password	path	/images/..%2fapply_abstract.cgi	Path traversal to apply_abstract.cgi to change administrator password (password reset).	CWE-22
_tn	query param	/images/..%2fcgi/cgi_sys_p.js	Path traversal to CGI script for password hash verification using httoken.	CWE-22

17 Jun 2026 03:33Current

8.1High risk

Vulners AI Score8.1

CVSS 27.5

CVSS 3.19.8

EPSS0.99982

SSVC