Hackers Exploiting New Auth Bypass Bug Affecting Millions of Arcadyan Routers

CVE-2020-29557 is a critical buffer overflow (CVSS 9.8) in the web interface of D-Link DIR-825 R1 routers running firmware through 3.0.1. Because the flaw is reachable without authentication, a remote attacker can send crafted requests to the router's HTTP management interface and trigger the overflow to execute arbitrary code on the device. Successful exploitation gives the attacker full control of the router, typically enabling traffic interception, further network compromise, or use of the device as an attack pivot or botnet node. Any DIR-825 R1 device whose management interface is reachable — especially units exposed directly to the internet — is affected. The flaw is listed in CISA's Known Exploited Vulnerabilities (added 2021-11-03) and a public proof-of-concept exists, indicating exploitation in the wild.

Do: Upgrade DIR-825 R1 devices to the fixed firmware released on 2020-11-20 or later, per D-Link's update instructions. Until patched, restrict or disable web-based administration from the WAN side and allow management access only from trusted networks. Given the KEV listing and ~54% EPSS, prioritize internet-facing units and review router logs for signs of compromise.

CVE-2021-1498 is an OS command injection flaw (CWE-78) caused by insufficient input validation in the Cisco HyperFlex HX Installer Virtual Machine, part of the HyperFlex HX Data Platform. An attacker who can reach the vulnerable interface can trigger the flaw and execute arbitrary commands on the affected device with the privileges of the tomcat8 user. Successful exploitation allows the attacker to run commands on the underlying system, potentially facilitating further compromise of the HyperFlex cluster. Organizations running Cisco HyperFlex HX deployments with the affected HX Installer VM are exposed. The vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog as of 2021-11-03, indicating exploitation in the wild, and EPSS assigns it a 100.0% probability of exploitation within 30 days (100th percentile).

Do: Apply the updated HyperFlex HX Data Platform software per Cisco's security advisory, as required by the CISA KEV catalog (due date per KEV policy for federal agencies). Restrict access to the HX Installer VM web interface to trusted management networks while patching. Review affected systems for signs of unexpected command execution by the tomcat8 user, given confirmed in-the-wild exploitation.

CVE-2021-20090 is a path traversal flaw (CWE-22) in the web interface of Arcadyan's Buffalo router firmware. By sending crafted HTTP requests containing directory traversal sequences, an unauthenticated, remote attacker can bypass the device's authentication. Successful exploitation grants access to sensitive information and otherwise protected functionality on the router without valid credentials. The flaw affects multiple router models across several different vendors, because Arcadyan's Buffalo firmware is embedded in a range of OEM and ISP-distributed products. Exploitation is confirmed in the wild: the vulnerability was added to CISA's KEV catalog on 2021-11-03, and EPSS rates the probability of exploitation within 30 days at 100% (100th percentile).

Do: Apply firmware updates from the router vendor as directed in the CISA KEV required action. Until patched, restrict or disable WAN-side remote management of the device's web interface. Review router configurations for unauthorized changes after patching, since unauthenticated remote access was possible.

CVE-2021-22502 is an unauthenticated OS command injection flaw (CWE-78) in Micro Focus Operation Bridge Reporter (OBR) version 10.40, rated critical (CVSS 9.8) because it is reachable over the network with no privileges or user interaction required. By sending crafted input to the exposed OBR service, an attacker can inject operating-system commands that are executed directly on the OBR server. Successful exploitation yields full remote code execution with the privileges of the affected service, giving attackers a foothold in enterprise IT operations environments. Organizations running OBR 10.40 — an enterprise IT-operations analytics/reporting server — are affected, particularly where the OBR interface is reachable from untrusted networks. Exploitation status is high-concern: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, a public proof-of-concept for unauthenticated command injection exists, and EPSS puts the 30-day exploitation probability at 96.7% (top percentile).

Do: Apply the vendor update for Operation Bridge Reporter per Micro Focus/OpenText instructions, as required by the CISA KEV catalog; confirm the deployed OBR build resolves 10.40. Until patched, restrict network access to the OBR server (firewall rules, VPN-only access) and hunt for signs of compromise such as unexpected processes, suspicious outbound connections, or web-shell artifacts on the server.

Micro Focus Access Manager, an enterprise single sign-on and identity management product (formerly sold as Novell/NetIQ Access Manager), contains an information leakage vulnerability caused by a SAML service provider redirection issue when the Assertion Consumer Service (ACS) URL is used. An attacker who triggers or influences the ACS redirect path can cause SAML sign-in responses or session information to be delivered to an unintended, potentially attacker-controlled destination, exposing sensitive authentication data. The practical gain for an attacker is disclosure of federated sign-in material, which can support session hijacking or user impersonation in SAML-based flows. Any organization running Micro Focus Access Manager in a SAML service provider role is potentially affected; the source data provides no version ranges, so administrators must consult the vendor advisory for affected and fixed releases. The flaw was added to CISA's Known Exploited Vulnerability (KEV) catalog on 2021-11-03, confirming in-the-wild exploitation; no public proof-of-concept is known, CVSS has not yet been scored, and EPSS estimates a 25.7% probability of exploitation within 30 days (98th percentile).

Do: Apply the Micro Focus update for CVE-2021-22506 per the vendor security bulletin, which is CISA's required action for this KEV entry; since no fixed version numbers are given in the source data, verify your installed Access Manager release against the bulletin before patching. Review whether your deployment acts as a SAML service provider, inspect Assertion Consumer Service URL and redirect handling, and check authentication logs for unexpected redirects or assertion leakage. Treat this as urgent given confirmed in-the-wild exploitation and the elevated EPSS score, even though no public proof-of-concept exists.

Tenda AC11 routers running firmware through 02.03.01.104_CN contain a stack buffer overflow (CWE-787 out-of-bounds write) in the /goform/setmac web endpoint. An unauthenticated attacker can trigger it with a crafted HTTP POST request, overwriting stack memory and executing arbitrary code on the device. Successful exploitation yields full control of the router, enabling traffic interception, lateral movement into the attached home or small-office network, or use in botnets. All AC11 units on affected CN firmware are in scope; no other Tenda products are named in this advisory. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), carries a very high EPSS score of 86.9%, and public proof-of-concept exploit material is available on GitHub.

Do: Upgrade AC11 firmware to a release newer than 02.03.01.104_CN per Tenda's instructions (no specific fixed version is provided in this data), as required by the CISA KEV catalog. Until patched, disable or restrict WAN-facing HTTP management and monitor for unexpected POST requests to /goform/setmac. Review whether the router is reachable from the internet, since unauthenticated network access is all an attacker needs.