CVE-2021-20090 is a path traversal vulnerability in Arcadyan Buffalo Firmware. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 November 2021, which means attackers have used it in real attacks. Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information.
What This Vulnerability Means in Practice
Path traversal in router firmware is dangerous because it can let a remote requester step outside intended file paths and reach configuration, status, or other sensitive resources that should never be exposed to unauthenticated users.
In embedded networking products, that matters more than in a typical web app because the exposed surface often includes device settings, credentials, logs, and management functions that support the whole local network. For a broader view of how path traversal fits into web exploitation patterns, see the Web Application Attacks Guide.
Why This Kind of Router Firmware Flaw Is Exploited
Firmware bugs are attractive when they sit in management interfaces or other exposed services, because a single request can bypass normal access boundaries and reveal information that helps an attacker move from initial access to deeper compromise.
That is why exploited vulnerability records matter. The CVE Program provides the authoritative identifier, while the NIST National Vulnerability Database is the place to confirm the public record, metadata and downstream references for the issue.
When a vulnerability is in CISA’s KEV catalogue, it is no longer a theoretical weakness, it is a known exploitation problem that security teams should treat as a live exposure until the affected devices are found and addressed.
How Organisations Check Exposure and Reduce Impact
Exposure review starts with knowing where the product exists, whether it is internet reachable, and whether the management interface is directly exposed or hidden behind another control. In practice, teams should use asset inventory, external attack-surface checks and vendor guidance together, because firmware issues are often missed when devices sit outside ordinary server patch workflows.
If remediation is delayed, compensating controls usually focus on removing remote reachability, isolating the management plane, restricting administrative access, and monitoring for unusual access to device settings or files. For vulnerability scoping and prioritisation, NHIMG’s Vulnerability Management Guide is a useful companion reference.
What Compromise Can Mean for Identity and Trust
Although this is a firmware vulnerability, the downstream concern is often identity-related: device credentials, session material, configuration secrets, and administrative trust can all be exposed or abused once an attacker reaches sensitive firmware content.
That is why post-exploitation review should look beyond the specific path traversal itself and ask whether the device stored reusable credentials, shared secrets, or management tokens that could be copied and reused elsewhere. Where firmware exposes those values, the blast radius can extend well beyond the router itself.
For teams dealing with firmware weaknesses that disclose credentials or other secret material, HPE Aruba Instant On hard-coded credentials is a relevant analogue, because it shows how embedded secrets can turn a device flaw into a broader access problem.
Risk and Threat Considerations
This class of flaw is dangerous because unauthenticated remote access to firmware resources can expose configuration data, device state, or stored secrets that help an attacker persist or pivot. In exposed networking gear, even a limited read path can become a practical stepping stone to broader compromise.
Failure mechanism: The attacker abuses path normalisation weaknesses to escape the intended directory, then reads files or metadata that should only be available through authenticated management paths.
Impact: Sensitive information disclosure can enable follow-on abuse, including credential theft, management-plane tampering, device takeover, or access to adjacent systems that trust the compromised appliance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | Path traversal in firmware requires timely flaw remediation and exposure review. |
| CM-6 — Configuration Settings | Router firmware exposure is reduced by hardening management and file-access settings. | |
| IA-5 — Authenticator Management | Device files may expose secrets that require credential and authenticator lifecycle control. | |
| Recommendation — Prioritise remediation for exposed firmware flaws and verify affected devices are updated or mitigated. Restrict management-plane exposure and enforce secure configuration baselines for network appliances. Rotate compromised device secrets and review stored authenticators after exploitation. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV-listed exploitation makes asset inventory and rapid remediation central to this flaw. |
| CIS-4 — Secure Configuration of Enterprise Assets and Software | Management-plane hardening is the main compensating control when patching is delayed. | |
| Recommendation — Track exposed firmware assets continuously and prioritise confirmed exploited vulnerabilities for remediation. Harden device management interfaces and remove unnecessary external reachability. | ||
Practitioner Guidance
Why practitioners should care: Firmware path traversal should be treated as an exposure-management issue, not just a software defect. If the affected device is internet reachable, the realistic question is whether an attacker can already use it as an entry point or intelligence source.
What to watch for: Prioritise devices that are externally exposed, still running unmanaged firmware, or holding administrative secrets and network credentials. If you cannot patch immediately, reduce the attack surface first and verify whether the device has already been queried in unusual ways.
Practitioner takeaway: For KEV-listed firmware flaws, the highest-value work is usually exposure reduction, secret review, and compromise checking, not just patch scheduling.