Actively exploited · Published Apr 29, 2021 · Assigned by tenable
CVE-2021-20090
Critical 9.8 Exploited
In plain English
A critical-severity path traversal in Buffalo WSR-2533DHPL2, Buffalo WSR-2533DHP3. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Nov 17, 2021.
Official description
A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Buffalo WSR-2533DHPL2, Buffalo WSR-2533DHP3 | WSR-2533DHPL2 <=1.02, WSR-2533DHP3 <= 1.24 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H