Description
OS command injection vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS command if a specially crafted request is sent to a specific CGI program.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| BUFFALO | WXR-5700AX7S | firmware Ver. 1.27 and earlier | — |
| BUFFALO | WXR-5700AX7B | firmware Ver. 1.27 and earlier | — |
| BUFFALO | WSR-3200AX4S | firmware Ver. 1.26 and earlier | — |
| BUFFALO | WSR-3200AX4B | firmware Ver. 1.25 | — |
| BUFFALO | WSR-2533DHP2 | firmware Ver. 1.22 and earlier | — |
| BUFFALO | WSR-A2533DHP2 | firmware Ver. 1.22 and earlier | — |
| BUFFALO | WSR-2533DHP3 | firmware Ver. 1.26 and earlier | — |
| BUFFALO | WSR-A2533DHP3 | firmware Ver. 1.26 and earlier | — |
| BUFFALO | WSR-2533DHPL2 | firmware Ver. 1.03 and earlier | — |
| BUFFALO | WSR-2533DHPLS | firmware Ver. 1.07 and earlier | — |
| BUFFALO | WSR-2533DHPLB | firmware Ver. 1.05 | — |
| BUFFALO | WEX-1800AX4 | firmware Ver. 1.13 and earlier | — |
| BUFFALO | WEX-1800AX4EA | firmware Ver. 1.13 and earlier | — |