Emerging Threatcriticaltest

Arcadyan Router Exploitations

Detects exploitation of vulnerabilities in Arcadyan routers as reported in CVE-2021-20090 and CVE-2021-20091.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Bhabesh RajCreated Tue Aug 24Updated Mon Jan 02f0500377-bc70-425d-ac8c-e956cd9068712021

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic

detection:
    path_traversal:
        # CVE-2021-20090 (Bypass Auth: Path Traversal)
        cs-uri-query|contains: '..%2f'
    config_file_inj:
        cs-uri-query|contains|all:
            # Chaining of CVE-2021-20090 (Bypass Auth) and CVE-2021-20091 (Config File Injection)
            - '..%2f'
            - 'apply_abstract.cgi'
    noauth_list:
        cs-uri-query|contains:
            - '/images/'
            - '/js/'
            - '/css/'
            - '/setup_top_login.htm'
            - '/login.html'
            - '/loginerror.html'
            - '/loginexclude.html'
            - '/loginlock.html'
    condition: (path_traversal or config_file_inj) and noauth_list