title: Arcadyan Router Exploitations
id: f0500377-bc70-425d-ac8c-e956cd906871
status: experimental
description: Detects exploitation of vulnerabilities in Arcadyan routers as reported in CVE-2021-20090 and CVE-2021-20091.
references:
  - https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2
  - https://www.tenable.com/security/research/tra-2021-13
  - https://blogs.juniper.net/en-us/security/freshly-disclosed-vulnerability-cve-2021-20090-exploited-in-the-wild
author: Bhabesh Raj
date: 2021/08/24
modified: 2021/08/25
falsepositives:
  - Unknown
level: critical
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2021.20090
    - cve.2021.20091
logsource: 
  category: webserver
detection:
  path_traversal:
    c-uri|contains: # CVE-2021-20090 (Bypass Auth: Path Traversal)
      - '..%2f'
  config_file_inj:
    c-uri|contains|all: # Chaining of CVE-2021-20090 (Bypass Auth) and CVE-2021-20091 (Config File Injection)
      - '..%2f'
      - 'apply_abstract.cgi'
  noauth_list:
    c-uri|contains:
      - '/images/'
      - '/js/'
      - '/css/'
      - '/setup_top_login.htm'
      - '/login.html'
      - '/loginerror.html'
      - '/loginexclude.html'
      - '/loginlock.html'
  condition: (path_traversal or config_file_inj) and noauth_list