CVE-2021-20091: Code Injection
The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly sanitize user input. An authenticated remote attacker could leverage this vulnerability to alter device configuration, potentially gaining remote code execution.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-20091?
CVE-2021-20091 is a vulnerability in Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 that allows an authenticated remote attacker to alter device configuration and potentially gain remote code execution.
How does CVE-2021-20091 affect Buffalo WSR-2533DHPL2 firmware?
CVE-2021-20091 affects Buffalo WSR-2533DHPL2 firmware version <= 1.02 by not properly sanitizing user input, which can be exploited by an authenticated remote attacker to alter device configuration and potentially achieve remote code execution.
How does CVE-2021-20091 impact Buffalo WSR-2533DHP3 firmware?
CVE-2021-20091 impacts Buffalo WSR-2533DHP3 firmware version <= 1.24 by not properly sanitizing user input, allowing an authenticated remote attacker to manipulate device configuration and potentially execute code remotely.
What is the severity of CVE-2021-20091?
CVE-2021-20091 has a severity rating of 8.8 (high).
How can I mitigate CVE-2021-20091?
To mitigate CVE-2021-20091, update Buffalo WSR-2533DHPL2 firmware to version 1.03 or later, and update Buffalo WSR-2533DHP3 firmware to version 1.25 or later.