The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly restrict access to sensitive information from an unauthorized actor.

Nessus was able to determine that the remote Buffalo device is affected by multiple vulnerabilities:
  - A path traversal vulnerability in the web interfaces of certain Buffalo router models could     allow unauthenticated remote attackers to bypass authentication. (CVE-2021-20090)

  - The web interfaces of certain Buffalo router models do not properly sanitize user input. An     authenticated remote attacker could leverage this vulnerability to alter device configuration,     potentially gaining remote code execution. (CVE-2021-20091)

  - The web interfaces of certain Buffalo router models do not properly restrict access to     sensitive information from an unauthorized actor. (CVE-2021-20092)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

CVE-2021-20092

high

Tenable Plugins

critical