Web Exploitation of Arcadyan Router Path Traversal and Config Injection Attempts
Detects Arcadyan router exploit traffic by matching URL-encoded path traversal patterns in query strings linked to config injection.
- Category
- webserver
- Author
- Bhabesh Raj (SigmaHQ), DRL 1.1
- Published
- 2021-08-24
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags suspicious web requests targeting Arcadyan router interfaces that include URL-encoded path traversal patterns and attempt to reach a specific configuration CGI endpoint. It matters because these patterns are used to bypass access controls and inject configuration content, enabling unauthorized changes. The detection relies on HTTP request telemetry that includes the full URI query string and matches specific query substrings used in the exploit chain.
Reporting behind it
- medium.comhttps://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2
- tenable.comhttps://www.tenable.com/security/research/tra-2021-13
- blogs.juniper.nethttps://blogs.juniper.net/en-us/security/freshly-disclosed-vulnerability-cve-2021-20090-exploited-in-the-wild
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-20090/web_cve_2021_20090_2021_20091_arcadyan_router_exploit.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Web Exploitation of Arcadyan Router Path Traversal and Config Injection Attempts
id: 29b44751-b68c-428b-a27d-57294f0f4ecb
status: test
description: This rule flags suspicious web requests targeting Arcadyan router interfaces that include URL-encoded path traversal patterns and attempt to reach a specific configuration CGI endpoint. It matters because these patterns are used to bypass access controls and inject configuration content, enabling unauthorized changes. The detection relies on HTTP request telemetry that includes the full URI query string and matches specific query substrings used in the exploit chain.
references:
- https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2
- https://www.tenable.com/security/research/tra-2021-13
- https://blogs.juniper.net/en-us/security/freshly-disclosed-vulnerability-cve-2021-20090-exploited-in-the-wild
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-20090/web_cve_2021_20090_2021_20091_arcadyan_router_exploit.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-08-24
modified: 2023-01-02
tags:
- attack.initial-access
- attack.t1190
- cve.2021-20090
- cve.2021-20091
- detection.emerging-threats
logsource:
category: webserver
detection:
path_traversal:
cs-uri-query|contains: ..%2f
config_file_inj:
cs-uri-query|contains|all:
- ..%2f
- apply_abstract.cgi
noauth_list:
cs-uri-query|contains:
- /images/
- /js/
- /css/
- /setup_top_login.htm
- /login.html
- /loginerror.html
- /loginexclude.html
- /loginlock.html
condition: (path_traversal or config_file_inj) and noauth_list
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: f0500377-bc70-425d-ac8c-e956cd906871
type: derived