Is CVE-2021-20716 actively exploited?

CVE-2021-20716 has no public evidence of in-the-wild exploitation as of 2024-11-21.

What is the CVSS score for CVE-2021-20716?

CVE-2021-20716 has a CVSS score of 9.8 (CRITICAL severity). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

How do I patch CVE-2021-20716?

Patch guidance is available from buffalo security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2021-20716.

Fix CVE-2021-20716 - CRITICAL buffalo bhr-4rv firmware

Q: Which products are affected by CVE-2021-20716?

35 products: buffalo bhr-4rv firmware, buffalo fs-g54 firmware, buffalo wbr2-b11 firmware, buffalo wbr2-g54 firmware, buffalo wbr2-g54-kd firmware, and 30 more.

Description

Hidden functionality in multiple Buffalo network devices (BHR-4RV firmware Ver.2.55 and prior, FS-G54 firmware Ver.2.04 and prior, WBR2-B11 firmware Ver.2.32 and prior, WBR2-G54 firmware Ver.2.32 and prior, WBR2-G54-KD firmware Ver.2.32 and prior, WBR-B11 firmware Ver.2.23 and prior, WBR-G54 firmware Ver.2.23 and prior, WBR-G54L firmware Ver.2.20 and prior, WHR2-A54G54 firmware Ver.2.25 and prior, WHR2-G54 firmware Ver.2.23 and prior, WHR2-G54V firmware Ver.2.55 and prior, WHR3-AG54 firmware Ver.2.23 and prior, WHR-G54 firmware Ver.2.16 and prior, WHR-G54-NF firmware Ver.2.10 and prior, WLA2-G54 firmware Ver.2.24 and prior, WLA2-G54C firmware Ver.2.24 and prior, WLA-B11 firmware Ver.2.20 and prior, WLA-G54 firmware Ver.2.20 and prior, WLA-G54C firmware Ver.2.20 and prior, WLAH-A54G54 firmware Ver.2.54 and prior, WLAH-AM54G54 firmware Ver.2.54 and prior, WLAH-G54 firmware Ver.2.54 and prior, WLI2-TX1-AG54 firmware Ver.2.53 and prior, WLI2-TX1-AMG54 firmware Ver.2.53 and prior, WLI2-TX1-G54 firmware Ver.2.20 and prior, WLI3-TX1-AMG54 firmware Ver.2.53 and prior, WLI3-TX1-G54 firmware Ver.2.53 and prior, WLI-T1-B11 firmware Ver.2.20 and prior, WLI-TX1-G54 firmware Ver.2.20 and prior, WVR-G54-NF firmware Ver.2.02 and prior, WZR-G108 firmware Ver.2.41 and prior, WZR-G54 firmware Ver.2.41 and prior, WZR-HP-G54 firmware Ver.2.41 and prior, WZR-RS-G54 firmware Ver.2.55 and prior, and WZR-RS-G54HP firmware Ver.2.55 and prior) allows a remote attacker to enable the debug option and to execute arbitrary code or OS commands, change the configuration, and cause a denial of service (DoS) condition.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector: network
Complexity: low
Privileges: none
User Action: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
Weaknesses: NVD-CWE-Other

Metadata

Primary Vendor: BUFFALO
Published: 4/28/2021
Last Modified: 11/21/2024
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

buffalo : bhr-4rv_firmwarebuffalo : fs-g54_firmwarebuffalo : wbr2-b11_firmwarebuffalo : wbr2-g54_firmwarebuffalo : wbr2-g54-kd_firmwarebuffalo : wbr-b11_firmwarebuffalo : wbr-g54_firmwarebuffalo : wbr-g54l_firmwarebuffalo : whr2-a54g54_firmwarebuffalo : whr2-g54_firmwarebuffalo : whr2-g54v_firmwarebuffalo : whr3-ag54_firmwarebuffalo : whr-g54_firmwarebuffalo : whr-g54-nf_firmwarebuffalo : wla2-g54_firmwarebuffalo : wla2-g54c_firmwarebuffalo : wla-b11_firmwarebuffalo : wla-g54_firmwarebuffalo : wla-g54c_firmwarebuffalo : wlah-a54g54_firmwarebuffalo : wlah-am54g54_firmwarebuffalo : wlah-g54_firmwarebuffalo : wli2-tx1-ag54_firmwarebuffalo : wli2-tx1-amg54_firmwarebuffalo : wli2-tx1-g54_firmwarebuffalo : wli3-tx1-amg54_firmwarebuffalo : wli3-tx1-g54_firmwarebuffalo : wli-t1-b11_firmwarebuffalo : wli-tx1-g54_firmwarebuffalo : wvr-g54-nf_firmwarebuffalo : wzr-g108_firmwarebuffalo : wzr-g54_firmwarebuffalo : wzr-hp-g54_firmwarebuffalo : wzr-rs-g54_firmwarebuffalo : wzr-rs-g54hp_firmware

Remediation Guidance

Executive Summary

View on NIST NVD