Multiple Vulnerabilities in Buffalo and Arcadyan manufactured routers

Tenable has discovered multiple vulnerabilities in routers manufactured by Arcadyan.

During the disclosure process for the issues discovered in the Buffalo routers, Tenable discovered that CVE-2021-20090 affected many more devices, as the root cause of the vulnerability exists in the underlying Arcadyan firmware. 

Please note that CVE-2021-20091 and CVE-2021-20092 have only been confirmed on Buffalo WSR-2533 models.

Path traversal vulnerability in the web interfaces of networking devices manufactured by Arcadyan, including Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24,  could allow unauthenticated remote attackers to bypass authentication.This vulnerability has also been confirmed to affect the following devices

note: the firmware versions listed do not indicate the latest affected firmware versions, only the firmware versions on which the issue was confirmed.Please contact the devices’ respective vendors for more information.

Further information available at – https://www.tenable.com/security/research/tra-2021-13

Duncan

Duncan is a technology professional with over 20 years experience of working in various IT roles. He has a interest in cyber security, and has a wide range of other skills in radio, electronics and telecommunications.