Critical Path Traversal (CVE‑2021‑20090) in Arcadyan Buffalo Firmware Allows Remote Bypass of Authentication
What It Is — A path‑traversal flaw in Arcadyan’s Buffalo router firmware that enables an unauthenticated, remote attacker to read arbitrary files on the device, potentially exposing credentials, configuration data, and internal network topology.
Exploitability — The vulnerability is publicly disclosed, with proof‑of‑concept code circulating; CVSS v3.1 base score 9.8 (Critical). No authentication is required and the attack can be launched over the network.
Affected Products — Arcadyan Buffalo firmware shipped on a range of consumer and small‑business routers from several OEMs (e.g., Netgear, TP‑Link, D‑Link).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous firmware inventory and patch‑level verification as part of a defensible control‑monitoring program.
- Highlights gaps in configuration‑management evidence that auditors often request when assessing network‑perimeter controls.
- Provides a concrete example of why continuous evidence collection (e.g., firmware version logs) is essential to prove due‑diligence in supply‑chain risk programs.
Recommended Actions
- Identify all network devices running Arcadyan Buffalo firmware via automated asset discovery.
- Verify firmware versions against the vendor’s advisory and apply the latest patched release immediately.
- Enable logging of firmware‑update events and retain logs for audit purposes.
- Integrate the firmware‑version check into your continuous control‑mapping workflow to keep evidence up‑to‑date.
- Document the remediation steps in your risk register to demonstrate remediation to auditors.
Source: CISA KEV – CVE‑2021‑20090