Buffalo WSR-2533DHPL2 and WSR-2533DHP3 Router Path Traversal Authentication Bypass Vulnerability (CVE-2021-20090) Analysis and Mitigation Guide

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2021-20090) is a critical path traversal and authentication bypass flaw residing in the web management interface of Buffalo routers built on Arcadyan OEM firmware. The root cause lies in the improper validation of input paths when the web server processes requests for static assets (such as images or CSS files). By failing to sanitize directory traversal sequences (e.g., '/images/..'), the web server allows unauthorized access to restricted administrative pages and APIs without a valid session.

2. Exploitation Mechanics & Attack Scenario

An attacker crafts an HTTP request targeting a non-authenticated static directory and appends directory traversal sequences ('..') to access restricted endpoints. For instance, while a direct request to '/cgi-bin/main.html' requires authentication, requesting '/images/../cgi-bin/main.html' tricks the web server's authentication filter into treating the request as a static asset access, thereby bypassing the security check and executing the administrative CGI script. This vulnerability is actively exploited in the wild by various botnets and threat actors.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability poses a severe threat. Successful exploitation allows remote attackers to hijack the router, modify DNS settings, upload malicious firmware, or pivot into the internal network, leading to potential data exfiltration and complete infrastructure compromise.