Sigma rule: Arcadyan Router Exploitations

Rule

Title

Arcadyan Router Exploitations

Status

test

Level

critical

Author

Bhabesh Raj

Date

2021-08-24

Modified

2023-01-02

File

rules-emerging-threats/2021/Exploits/CVE-2021-20090/web_cve_2021_20090_2021_20091_arcadyan_router_exploit.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects exploitation of vulnerabilities in Arcadyan routers as reported in CVE-2021-20090 and CVE-2021-20091.

Log source

category

webserver

Detection

path_traversal:
    # CVE-2021-20090 (Bypass Auth: Path Traversal)
    cs-uri-query|contains: '..%2f'
config_file_inj:
    cs-uri-query|contains|all:
        # Chaining of CVE-2021-20090 (Bypass Auth) and CVE-2021-20091 (Config File Injection)
        - '..%2f'
        - 'apply_abstract.cgi'
noauth_list:
    cs-uri-query|contains:
        - '/images/'
        - '/js/'
        - '/css/'
        - '/setup_top_login.htm'
        - '/login.html'
        - '/loginerror.html'
        - '/loginexclude.html'
        - '/loginlock.html'
condition: (path_traversal or config_file_inj) and noauth_list

False positives (as the rule lists them)

• Unknown

Tags

• attack.initial-access
• attack.t1190
• cve.2021-20090
• cve.2021-20091
• detection.emerging-threats

CVEs this rule names

• CVE-2021-20090
• CVE-2021-20091

MITRE ATT&CK ids this rule names

• T1190

References

• https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2
• https://www.tenable.com/security/research/tra-2021-13
• https://blogs.juniper.net/en-us/security/freshly-disclosed-vulnerability-cve-2021-20090-exploited-in-the-wild

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2021/Exploits/CVE-2021-20090/web_cve_2021_20090_2021_20091_arcadyan_router_exploit.yml