Arcadyan Router Vulnerability Exploitation (CVE-2021-20090, CVE-2021-20091)

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•1•0•21

Detects exploitation attempts targeting Arcadyan routers, specifically looking for path traversal (CVE-2021-20090) and configuration file injection (CVE-2021-20091) vulnerabilities. The rule identifies requests containing '..%2f' (URL-encoded path traversal) and, for the configuration file injection, also 'apply_abstract.cgi', combined with requests to unauthenticated paths.