CVE-2021-33558: Boa web server information disclosure (disputed)
The short version: CVE-2021-33558 describes an information-disclosure issue in the Boa web server (version 0.94.13), where certain files could expose sensitive information. The finding is disputed — third parties note the named files aren't part of Boa itself — and Boa has been unmaintained for roughly two decades. The more useful signal is usually the presence of Boa at all.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — disputed and site-specific; the bigger issue is running Boa at all |
| CVSS v3.1 (NVD) | 7.5 — High · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 10.33% · 95.20th percentile (2026-07-17) |
| In CISA KEV? | No |
| Known exploited? | Not confirmed; the CVE is disputed |
| Vulnerability type | Information disclosure via specific web files |
| Requires authenticated session? | No — pre-authentication |
| Affected | Boa 0.94.13 (as reported) |
| Fixed in | Unknown at time of writing — Boa is unmaintained; no vendor patch exists |
What you need to know
The report claims that files such as backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, and config.js could be retrieved to obtain sensitive information. The important caveat: multiple third parties dispute it, on the basis that those files are not shipped with Boa and would be additions made by a specific deployment — making any exposure site-specific rather than a flaw in Boa itself.
- Boa is legacy software. It's a lightweight web server that was popular in embedded devices and has been effectively unmaintained since the mid-2000s.
- The real risk is usually the platform. Boa most often turns up baked into routers, cameras, and other appliances, where it's frequently paired with far more serious, well-documented vulnerabilities.
- This specific CVE is weak evidence. Whether it applies depends entirely on whether a given device actually serves those files.
How serious we see it
High, as a standalone finding — it's disputed, site-specific, and confidentiality-only. We won't dress up a contested information-disclosure report as a crisis. What genuinely deserves attention is the presence of an unmaintained Boa server on your internet-facing footprint: legacy embedded web servers rarely receive fixes, tend to accumulate known issues, and are a reasonable prompt to ask whether the device behind it should be exposed at all.
What to do
- Confirm whether the named files are actually served. If they aren't, this CVE doesn't apply to your deployment.
- Restrict exposure. Keep Boa-based devices off the public internet or behind access controls; there's no vendor patch to rely on.
- Inventory the device, not just the server. Identify what appliance runs Boa and check it against its own known vulnerabilities and end-of-life status.
- Plan replacement of unmaintained gear. Long-abandoned embedded web servers are a standing liability regardless of this one CVE.
How BreachRisk sees it
BreachRisk discovers internet-facing web services in your external footprint, fingerprints the server software, and flags legacy components like Boa along with any version-based exposures associated with them. We identify and flag what's running; for a disputed, site-specific issue like this we surface the exposure honestly and in context rather than overstating it — the value is knowing an unmaintained server is on your perimeter before an attacker inventories it for you.