{
  "Name": "Arcadyan Routers Authentication Bypassing (CVE-2021–20090)",
  "Description": "A path traversal vulnerability (CVE-2021-20090) in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication. This vulnerability also affected many other devices, as the root cause of the vulnerability exists in the underlying Arcadyan firmware.\nAnother vulnerabilities, using Configuration File Injection (CVE-2021-20091) to open telnetd and using Improper Access Control(CVE-2021-20092) to get admin password, have only been confirmed on Buffalo WSR-2533 models.\nNotice: openTelnetd and closeTelnetd exploit will reboot target device, target may fail to reboot and remain shutting down. It is recommended to use openTelnetd/closeTelnetd exploit when getAdminPwd exploit is working.",
  "Product": "WSR-2533DHPL2 firmware version <= 1.02, WSR-2533DHP3 firmware version <= 1.24 and so on",
  "Homepage": "https://www.buffalo.jp/ and so on",
  "DisclosureDate": "2020-12-17",
  "Author": "Ovi3",
  "FofaQuery": "body=\"css/style-ad-JP.css\"",
  "Level": "3",
  "Impact": "",
  "Recommendation": "update",
  "Translation": null,
  "References": [],
  "RealReferences": [
    "https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2",
	"https://zh-cn.tenable.com/security/research/tra-2021-13?tns_redirect=true"
  ],
  "HasExp": true,
  "ExpParams": [
    {
      "name": "attackType",
      "type": "select",
      "value": "getInfo,getAdminPwd,openTelnet,closeTelnet"
    }
  ],
  "Is0day": false,
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": null,
  "ExploitSteps": null,
  "VulType": null,
  "Tags": null,
  "CVEIDs": [
    "CVE-2021–20090", "CVE-2021-20091", "CVE-2021-20092"
  ],
  "CVSSScore": "8.1",
  "CNNVDIDs": null,
  "AttackSurfaces": {
    "Application": null,
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  },
  "Disable": false
}