CVE-2021-20090

What it actually does

CVE-2021-20090 is an unauthenticated path traversal vulnerability in the web management interface of affected Buffalo WSR-2533DHPL2 and WSR-2533DHP3 router firmware. By using encoded directory traversal sequences in HTTP requests, an attacker can reach web interface resources that should require authentication. Because the management interface controls router configuration, successful exploitation can expose sensitive device information, allow unauthorized configuration changes, and potentially enable follow-on compromise depending on exposed administrative functions and device configuration. The vulnerability is remotely reachable over the network, requires no credentials, and has been actively exploited in the wild.

Why it matters to the business

Compromise of an affected router can disrupt network connectivity, redirect traffic, weaken perimeter defenses, expose internal network details, or allow the device to be enrolled into botnets for scanning and denial-of-service activity. Because this vulnerability is listed in CISA KEV, has a very high EPSS score, and has been exploited for years, any internet-exposed or untrusted-network-accessible affected device should be treated as high-risk and remediated urgently. Organizations that rely on these routers for branch, small-office, or remote connectivity may face outages, traffic interception risk, and incident response costs if devices are not updated or isolated.

How an attack unfolds

An attacker scans the internet or local network for Buffalo WSR-2533DHPL2 or WSR-2533DHP3 routers exposing their web administration service. After identifying a target, the attacker sends crafted HTTP requests containing encoded path traversal sequences, commonly using patterns such as `/images/..%2f`, to access administrative CGI endpoints or web pages without first authenticating. Once the authentication boundary is bypassed, the attacker may query device information, modify configuration, alter DNS or routing settings, enable remote access, attempt credential theft, or chain the access with additional device-specific weaknesses. Public exploitation activity has been observed, including broad automated scanning associated with Arcadyan/Buffalo firmware path traversal exploitation patterns and botnet-style activity against consumer and small-office routers.

How to fix it

Upgrade affected Buffalo router firmware to a vendor-fixed release newer than WSR-2533DHPL2 firmware version 1.02 and newer than WSR-2533DHP3 firmware version 1.24. If a fixed firmware image is not available for the deployed hardware, replace the device with a supported model. As immediate mitigations, disable remote web administration from the internet, restrict management access to trusted administrative networks only, block inbound access to the router management interface at upstream firewalls, change administrative credentials after patching, and reboot the device after applying firmware. Because exploitation can alter configuration, review DNS, port forwarding, UPnP, VPN, firewall, and remote-management settings after remediation.

How to confirm the fix worked

Confirm the device model and firmware version from the router administration interface or vendor-supported management tooling. Verify that WSR-2533DHPL2 devices are running firmware newer than 1.02 and WSR-2533DHP3 devices are running firmware newer than 1.24. From an untrusted network segment, confirm that the web administration interface is not reachable unless explicitly required and access-controlled. Test that unauthenticated requests using encoded traversal patterns such as `/images/..%2f` do not return administrative content or CGI responses. Review external attack-surface scans to ensure no affected router management interfaces are exposed to the internet.

Typical attack path

1. Scan for internet-facing or locally reachable Buffalo WSR-2533DHPL2 or WSR-2533DHP3 router web interfaces.
2. Fingerprint the device by HTTP headers, page content, firmware-specific paths, or response behavior.
3. Send crafted HTTP requests containing encoded path traversal sequences such as `/images/..%2f` to bypass authentication controls.
4. Access administrative pages or CGI endpoints that should normally require a logged-in session.
5. Retrieve device configuration or status information, or change router settings such as DNS, firewall, remote administration, or routing behavior.
6. Maintain access by enabling management features, changing credentials, or enrolling the device into automated botnet infrastructure.
7. Use the compromised router to proxy traffic, scan other systems, disrupt connectivity, or support further attacks.

How to detect it

Look for HTTP requests to router management interfaces containing encoded path traversal sequences, especially `/images/..%2f` or case variants, followed by access to administrative CGI endpoints or configuration pages without a valid authenticated session. Useful log sources include firewall logs, IDS/IPS alerts, reverse proxy logs if management traffic is proxied, router web administration logs where available, DHCP/NAT logs, DNS logs, and network flow records. Because many routers retain limited logs, also look for secondary evidence: unexpected DNS server changes, new port-forwarding rules, remote administration enabled, changed administrator password, unexplained reboots, unusual outbound scanning from the router’s public IP, or traffic to known botnet command-and-control infrastructure. Historical detection should focus on traffic to HTTP/HTTPS management ports from unknown external sources, repeated traversal probes, and requests for CGI resources that should only be accessible after login.

• /images/..%2f
• /images/..%2F
• /images/../
• GET /images/..%2f
• GET /images/..%2F
• POST /images/..%2f
• POST /images/..%2F
• /images/..%2fapply_abstract.cgi
• /images/..%2Fapply_abstract.cgi
• /apply_abstract.cgi
• %2fapply_abstract.cgi
• ..%2fapply_abstract.cgi
• ..%2Fapply_abstract.cgi
• /images/..%2fstatus.htm
• /images/..%2Fstatus.htm
• /images/..%2finfo.html
• /images/..%2Finfo.html
• /images/..%2findex.htm
• /images/..%2Findex.htm

What your security team should do

• Immediately identify all Buffalo WSR-2533DHPL2 and WSR-2533DHP3 routers and determine firmware versions.
• Prioritize remediation for any device reachable from the internet or from guest, unmanaged, or untrusted networks.
• Upgrade firmware to a vendor-fixed release newer than the affected versions, or replace unsupported devices.
• Disable internet-facing remote administration and restrict management interfaces to trusted administrative networks only.
• Review router configuration after patching, especially DNS servers, port forwarding, UPnP, firewall rules, VPN settings, and remote-management options.
• Rotate router administrative credentials after remediation and remove unknown accounts or configuration changes.
• Search firewall, web, IDS/IPS, and network telemetry for historical requests containing encoded traversal strings such as `/images/..%2f`.
• Monitor for botnet-style follow-on behavior from affected networks, including unusual outbound scanning, high-volume connections, or unexpected DNS changes.
• Treat signs of successful exploitation as a network device compromise and perform configuration validation, firmware reinstallation where supported, or hardware replacement.