CVE-2021-20090VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2021-20090: Arcadyan Buffalo Firmware Path Traversal Vulnerability

Affects Arcadyan Buffalo FirmwareSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 11/17/2021
EPSS: 100.0% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-20090 (opens in a new tab)

Description

Arcadyan Buffalo firmware contains a path traversal vulnerability that allows unauthenticated remote attackers to bypass authentication and access sensitive information. This vulnerability affects multiple routers from different vendors. It has been exploited in the wild. No specific affected versions or patch information is provided.

Summary

CVE-2021-20090 is a path traversal vulnerability in Arcadyan Buffalo firmware that enables unauthenticated remote attackers to bypass authentication mechanisms and access sensitive information on affected routers. The vulnerability impacts multiple router models from various vendors using this firmware. Exploitation has been observed in the wild, indicating active threat usage. No detailed version or patch information is available in the provided data.

Impact

Successful exploitation allows unauthenticated attackers to bypass authentication controls and access sensitive information on affected devices. This can lead to unauthorized disclosure of potentially sensitive data. The vulnerability has been exploited in the wild, confirming its practical impact.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict network access to affected devices and monitor for suspicious activity related to this vulnerability.

Weaknesses

CWE-22Path Traversal (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:40:40 UTC

Weaknesses

References

Related threats