Pierluigi Paganini August 07, 2021

Threat actors are actively exploiting a critical authentication bypass issue (CVE-2021-20090) affecting home routers with Arcadyan firmware.

Threat actors actively exploit a critical authentication bypass vulnerability, tracked as CVE-2021-20090, impacting home routers with Arcadyan firmware to deploy a Mirai bot.

“A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication.” reads the advisory published by Tenable.

This flaw potentially affects millions of IOT devices manufactured by no less than 17 vendors, including some ISPs. 

The ongoing attacks were spotted by researchers from Juniper Threat Labs, experts believe that were conducted by a threat actor that targeted IoT devices in a campaign since February.

“As of August 5, we have identified some attack patterns that attempt to exploit this vulnerability in the wild coming from an IP address located in Wuhan, Hubei province, China. The attacker seems to be attempting to deploy a Mirai variant on the affected routers using scripts similar in name to the ones mentioned by Palo Alto Networks in March. We had witnessed the same activity starting February 18.” reads the analysis published by Juniper experts. “The similarity could indicate that the same threat actor is behind this new attack and attempting to upgrade their infiltration arsenal with yet another freshly disclosed vulnerability.”

The ongoing attacks were discovered by Juniper Threat Labs researchers while monitoring the activity of a threat actor known for targeting network and IoT devices since February.

According to the experts, between June 6, 2021, and July 23, the threat actor started exploiting the following vulnerabilities:

1. CVE-2020-29557 (DLink routers)
2. CVE-2021-1497 and CVE-2021-1498 (Cisco HyperFlex)
3. CVE-2021-31755  (Tenda AC11)
4. CVE-2021-22502 (MicroFocus OBR)
5. CVE-2021-22506 (MicroFocus AM)
6. a couple more exploits from exploit-db with no related CVEs.

Experts pointed out that attackers continue to add new exploits to their arsenal.

Tenable researchers shared a list of affected devices:

The CVE-2021-20090 flaw existed in Arcadyan’s firmware for at least ten years, this means that every vendor that used it in its models automatically inherited the bug.

Researchers also shared Indicators of compromise (IOCs) associated with the last wave of attacks attributed to this threat actor.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, CVE-2021-20090)

[adrotate banner=”5″]

[adrotate banner=”13″]