9.8
CVE-2021-20090
- EPSS 94.4%
- Veröffentlicht 29.04.2021 15:15:10
- Zuletzt bearbeitet 03.11.2025 18:59:30
- Quelle vulnreport@tenable.com
- CVE-Watchlists
- Unerledigt
LoginA path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Buffalo ≫ Wsr-2533dhpl2-bk Firmware Version <= 1.02
Buffalo ≫ Wsr-2533dhp3-bk Firmware Version <= 1.24
03.11.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog
Arcadyan Buffalo Firmware Path Traversal Vulnerability
SchwachstelleArcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information. This vulnerability affects multiple routers across several different vendors.
BeschreibungApply updates per vendor instructions.
Erforderliche Maßnahmen| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 94.4% | 1 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 7.5 | 10 | 6.4 |
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.