CVE-2021-20090
Arcadyan Buffalo Firmware Path Traversal Vulnerability
Published Apr 29, 2021 · updated Jun 16, 2026 · buffalo wsr-2533dhpl2-bk firmware
Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information. This vulnerability affects multiple routers across several different vendors.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 29, 2021 · Catalog
Detected
Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information. This vulnerability affects multiple routers across several different vendors.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Nov 17, 2021 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information. This vulnerability affects multiple routers across several different vendors.
Required action
Apply updates per vendor instructions.
CISA due date Nov 17, 2021
Affected
- cpe buffalo/wsr-2533dhp3-bk firmwareversion unspecified
- cpe buffalo/wsr-2533dhpl2-bk firmwareversion unspecified
- vendor Arcadyan Buffalo Firmwareversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2021-20090
Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information. This vulnerability affects multiple routers across several different vendors.
cisa.gov - CVE.orgVulnerability recordCVE-2021-20090
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2021-20090
30-day exploitation probability 100.0%
first.org - NIST NVDVulnerability recordCVE-2021-20090
A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication.
nvd.nist.gov