admin/GobyVuls
1
0 Fork 0
mirror of https://github.com/gobysec/GobyVuls.git synced 2026-10-24 17:04:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

add Arcadyan_Routers_Authentication_Bypassing_CVE_2021_20090

Browse Source
This commit is contained in:
gobysec committed 2021-08-04 20:40:11 +08:00
1 parent 5f7195eb14
commit 6206df14f6
2 files changed
+11
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

Arcadyan/CVE-2021-20090/Arcadyan_Routers_Authentication_Bypassing_CVE_2021_20090.gif
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 1.3 MiB

Arcadyan/CVE-2021-20090/README.md
+11
View File
@@ -0,0 +1,11 @@
# Arcadyan Routers Authentication Bypassing (CVE-2021–20090)
A path traversal vulnerability (CVE-2021-20090) in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication. This vulnerability also affected many other devices, as the root cause of the vulnerability exists in the underlying Arcadyan firmware.
Another vulnerabilities, using Configuration File Injection (CVE-2021-20091) to open telnetd and using Improper Access Control(CVE-2021-20092) to get admin password, have only been confirmed on Buffalo WSR-2533 models.
**FOFA query rule**: [body="css/style-ad-JP.css"](https://fofa.so/result?qbase64=Ym9keT0iY3NzL3N0eWxlLWFkLUpQLmNzcyI%3D)
# Demo
![](Arcadyan_Routers_Authentication_Bypassing_CVE_2021_20090.gif)