Is CVE-2021-20090 (Arcadyan Buffalo Firmware Path Traversal) being exploited in the wild?

Yes. CISA added CVE-2021-20090 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information.

What “being exploited in the wild” means for this CVE

CISA’s KEV listing is the practical signal here. For defenders, that means CVE-2021-20090 should be treated as an active exposure issue, not a theoretical firmware bug. The right question is not whether the flaw exists, but whether the affected devices are still reachable, still trusted, and still able to be reached by unauthenticated attackers.

Because the issue is in firmware and the attack path is remote, the first operational concern is exposure at the network edge. If the device is internet-facing or reachable from untrusted internal segments, exploitation risk remains high until it is removed, isolated, or brought under the vendor’s corrective guidance.

How to confirm exposure and decide what to do first

Start with inventory, not patching assumptions. Identify every Arcadyan Buffalo device, confirm whether it is still in service, and determine whether it can be reached from outside the trust boundary. If you cannot quickly prove that the device is no longer exposed, treat it as potentially vulnerable and prioritise it ahead of lower-risk firmware issues.

Then verify the vendor’s advisory and CISA KEV entry for the exact remediation path. CISA Known Exploited Vulnerabilities Catalog should be used as the operational trigger, while the vendor notice provides the authoritative firmware instructions and any compensating controls.

Why path traversal on firmware matters operationally

Path traversal in firmware is dangerous because it can let an attacker escape the intended request path and reach data or functionality that should never be directly exposed. In this case, the direct answer already establishes that the flaw can support unauthenticated remote access to sensitive information, so the immediate concern is disclosure, not just service disruption.

For edge appliances, this kind of weakness often has a wide blast radius because the device may sit between users and core services. A single exposed appliance can reveal configuration data, credentials, session material, or internal topology details that help an attacker move from initial access to deeper compromise.

Risk and Threat Considerations

When a remotely reachable firmware flaw is confirmed as actively exploited, the practical risk is that defenders may miss silent compromise until the device is already being used as an entry point or reconnaissance source. The combination of unauthenticated access and sensitive data exposure makes this a strong candidate for rapid containment, even before every downstream impact is fully proven.

Failure mechanism: The attacker abuses path traversal to break out of the intended file or request scope, then uses the resulting access to read information that should have remained protected.

Impact: Sensitive information exposure can accelerate follow-on compromise, including credential theft, configuration harvesting, or preparation for broader network access.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active KEV exploitation calls for continuous exposure tracking and remediation prioritisation.
Recommendation — Prioritise and remediate KEV-listed assets first.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The question is about an actively exploited flaw and what remediation posture is required.
	RA-5 — Vulnerability Monitoring and Scanning	Confirming whether the device is exposed depends on identifying vulnerable assets and reachability.
Recommendation — Track the flaw and apply vendor remediation promptly. Continuously scan and validate whether affected devices remain exposed.
NIST CSF 2.0	ID.RA-01 — Asset vulnerabilities are identified and recorded	Active exploitation makes asset-vulnerability awareness central to prioritisation.
	PR.PS-04 — Software, hardware, and firmware are patched and updated	Firmware exploitation requires timely patching or vendor-directed mitigation.
Recommendation — Record affected assets and elevate those with confirmed exploitation exposure. Apply the vendor firmware fix or mitigation as soon as possible.

Practitioner Guidance

What to prioritise: If the device is still reachable and cannot be immediately remediated, isolate it or remove external access first. For an actively exploited KEV item, exposure reduction is usually more valuable than waiting for a perfect maintenance window.

What to verify: Check whether any configuration, logs, or exported data associated with the device could already have been accessed. If the appliance stores reusable secrets, internal addresses, or admin material, treat those as potentially exposed and review whether rotation or reissuance is needed.

Decision rule: If you cannot prove the device is patched, removed, or effectively shielded from untrusted reachability, handle it as a live incident-prone asset rather than a routine maintenance task. The point is to close the attack path before you debate whether exploitation already happened.

Practitioner takeaway: For KEV-listed firmware flaws, the most important judgment is whether the vulnerable device is still reachable by an attacker, because active exposure is what turns a known bug into an immediate operational problem.