CVE-2021-20090: Buffalo router web interface path traversal allows auth bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated network reachability, KEV listing with a past remediation deadline and near-maximum EPSS make this an urgent edge-device fix.

What it is

The web interface of Buffalo WSR-2533DHPL2 (firmware <= 1.02) and WSR-2533DHP3 (firmware <= 1.24) is vulnerable to path traversal (CWE-22). An unauthenticated remote attacker can use the traversal to bypass authentication on the device's web management interface. Because these are edge devices, a bypass exposes the router itself and the network behind it.

Impact

An attacker gains unauthenticated access to the router's web interface, effectively taking over device management and enabling further compromise of the network behind it. The CVSS 3.1 vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reachable over the network via the device web interface (AV:N, PR:N, UI:N), so no credentials or user interaction are required. The flaw is in the web interface itself, so any internet- or LAN-exposed management interface is a candidate path.

Exploitation

CISA added it to KEV on 2021-11-03 with a 2021-11-17 remediation due, and references carry Exploit tags; EPSS 30-day probability is 0.99983 (99.98th percentile). No ransomware campaign use is documented in the record.

What to do

• Apply the vendor firmware updates for WSR-2533DHPL2 and WSR-2533DHP3 per vendor instructions (CISA KEV required action).
• If patching is not immediately possible, remove the web management interface from untrusted exposure (disable remote/WAN administration, restrict to a trusted management segment).
• Isolate affected devices on a segmented network until they are updated.
• Replace devices that no longer receive firmware support.
• Verify the update actually applied and re-check exposure of the management interface.

Detection

• Monitor web interface access logs on affected Buffalo devices for traversal-style request paths and unexpected unauthenticated requests.
• Alert on management-interface logins or configuration changes from unexpected source addresses.
• Watch network traffic to the device web interface from external or non-management networks.
• Hunt for post-exploitation changes to router configuration, DNS settings or firmware.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.