High · 8.0 CVE-2022-43443 EUVD-2022-46445GHSA-242r-mxxc-q586

OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a s…

Published Dec 19, 2022 · Updated Apr 17, 2025 · Assigned by jpcert

Vendor: BUFFALO Product: WCR-1166DS Product: WSR-1166DHP Product: WSR-1166DHP2 Product: WSR-2533DHP Product: WSR-2533DHP2 Product: WSR-2533DHP3 Product: WSR-2533DHPL Product: WSR-2533DHPL2 Product: WSR-2533DHPLB Product: WSR-2533DHPLS Product: WSR-3200AX4B Product: WSR-3200AX4S Product: WSR-A2533DHP2 Product: WSR-A2533DHP3 Product: WXR-11000XE12 Product: WXR-5700AX7B Product: WXR-5700AX7S

Description

OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted request is sent to the management page.

Affected products

Vendor	Product	Affected	Fixed
BUFFALO	WXR-11000XE12	firmware Ver. 1.10 and earlier	—
BUFFALO	WXR-5700AX7S	firmware Ver. 1.27 and earlier	—
BUFFALO	WXR-5700AX7B	firmware Ver. 1.27 and earlier	—
BUFFALO	WSR-3200AX4S	firmware Ver. 1.26 and earlier	—
BUFFALO	WSR-3200AX4B	firmware Ver. 1.25	—
BUFFALO	WSR-2533DHP	firmware Ver. 1.08 and earlier	—
BUFFALO	WSR-2533DHP2	firmware Ver. 1.22 and earlier	—
BUFFALO	WSR-A2533DHP2	firmware Ver. 1.22 and earlier	—
BUFFALO	WSR-2533DHP3	firmware Ver. 1.26 and earlier	—
BUFFALO	WSR-A2533DHP3	firmware Ver. 1.26 and earlier	—
BUFFALO	WSR-2533DHPL	firmware Ver. 1.08 and earlier	—
BUFFALO	WSR-2533DHPL2	firmware Ver. 1.03 and earlier	—
BUFFALO	WSR-2533DHPLS	firmware Ver. 1.07 and earlier	—
BUFFALO	WSR-2533DHPLB	firmware Ver. 1.05	—
BUFFALO	WSR-1166DHP	firmware Ver. 1.16 and earlier	—
BUFFALO	WSR-1166DHP2	firmware Ver. 1.17 and earlier	—
BUFFALO	WCR-1166DS	firmware Ver. 1.34 and earlier	—

References