CVE-2021-20090: Arcadyan Buffalo Firmware Path Traversal Vulnerability

CVE-2021-20090 is a path traversal vulnerability in Arcadyan Buffalo firmware used in multiple routers across several vendors. Unauthenticated remote attackers can abuse it to bypass authentication and reach sensitive information on the device. For IT and security teams, this matters because consumer and small-business routers often sit at the network edge with weak segmentation, so a successful bypass can expose credentials, configuration data, or a foothold for further access.

Public detail is limited to the CISA description and the CWE-22 classification. Confirm exact product lists, fixed builds, and deployment guidance against the relevant vendor advisories before acting.

How it works

The weakness is CWE-22 (improper limitation of a pathname to a restricted directory). In this class of flaw, the device accepts attacker-controlled path elements (commonly sequences that traverse parent directories) without sufficient canonicalization or allow-list checks. When the web management or related service resolves those paths, the request can escape the intended document root or authenticated area.

According to the CISA summary, an unauthenticated remote attacker can use the path traversal to bypass authentication and access sensitive information. Typical abuse patterns for this class involve crafting HTTP requests that reference files or endpoints outside the normal authenticated scope. Exact request format, parameters, and reachable files are not provided in the given facts; treat any public proof-of-concept material as untrusted until validated against your own lab and the vendor advisory.

Am I affected? How to find it in your systems

Arcadyan Buffalo firmware appears in routers sold under multiple vendor brands. These devices commonly serve as home, branch, or small-office gateways, Wi-Fi access points, or ISP-supplied CPE. Inventory should cover both corporate-managed and BYOD/remote-worker equipment that may still be reachable from the internet or from less-trusted network segments.

• Build an asset list of routers and gateways; record make, model, firmware version, and whether the management interface is exposed to WAN, VPN, or guest networks.
• Compare each device against the vendor’s advisory for CVE-2021-20090 or the Arcadyan Buffalo path-traversal issue; do not assume a model is safe merely because the branding differs.
• Check configuration backups, DHCP/DNS inventories, and network management platforms for Arcadyan-based or Buffalo-related firmware strings.
• For detection of exploitation attempts, review web-server or management-plane logs for unusual path strings (directory traversal sequences, attempts to read sensitive files, or unauthenticated access to admin resources). Correlate with sudden configuration changes, new admin accounts, or unexpected outbound connections. Specific IoCs are not supplied in the facts; confirm any signatures with the vendor or your threat-intel source.

How to remediate

Patch first. CISA’s required action is to apply updates per vendor instructions. Obtain the fixed firmware only from the device vendor’s official support channel, verify integrity if hashes or signatures are published, and follow the vendor’s install and reboot procedure. After upgrading, re-check that the management interface version string matches the remediated build.

• If a device is end-of-life and will not receive a fix, plan replacement; continuing to run unpatched edge firmware is a persistent risk.
• After patching, change any credentials that may have been exposed, disable remote administration if it is not required, and restrict management access to a dedicated management VLAN or VPN.
• Harden remaining services: disable unused features (WPS, UPnP, remote WAN management, telnet), enforce strong unique passwords, and ensure logging is forwarded to a central collector.

If you can't patch immediately

Reduce exposure until the vendor update can be applied.

• Segment: place affected routers behind a firewall or on an isolated segment; block inbound WAN access to management ports (typically HTTP/HTTPS/admin interfaces) at the perimeter.
• Virtual patching / WAF: if a reverse proxy or WAF sits in front of the management interface, apply rules that reject path-traversal patterns and unauthenticated access to sensitive paths; tune to avoid breaking legitimate admin use.
• Disable the affected feature: turn off remote web administration, cloud management, or any service the advisory indicates is involved, if operationally feasible.
• Monitoring: increase logging verbosity on the device and upstream firewall; alert on traversal-like URIs, repeated unauthenticated hits to admin resources, and post-access configuration changes. Retain logs for incident review.
• Credential hygiene: rotate admin and Wi-Fi credentials on a precautionary basis if the device was internet-reachable.

If your data may have been exposed

Actively exploited edge vulnerabilities can lead to credential theft, configuration disclosure, or broader network compromise even when ransomware use is not documented for this CVE. If logs or telemetry suggest exploitation, treat the device as untrusted: isolate it, preserve evidence, rotate secrets that traversed the device, and hunt for lateral movement from the LAN side.

You can also run a free exposure scan of your email addresses against known breach data to see whether associated credentials have appeared in prior incidents, then force password resets and enable multi-factor authentication where possible.