Medium · 6.8 CVE-2022-43486 EUVD-2022-46485GHSA-2r4f-phw2-gpqp

Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable…

Published Dec 19, 2022 · Updated Apr 17, 2025 · Assigned by jpcert

Vendor: BUFFALO Product: WCR-1166DS Product: WEX-1800AX4 Product: WEX-1800AX4EA Product: WSR-2533DHP Product: WSR-2533DHP2 Product: WSR-2533DHP3 Product: WSR-2533DHPL Product: WSR-2533DHPL2 Product: WSR-2533DHPLB Product: WSR-2533DHPLS Product: WSR-3200AX4B Product: WSR-3200AX4S Product: WSR-A2533DHP2 Product: WSR-A2533DHP3 Product: WXR-5700AX7B Product: WXR-5700AX7S

Description

Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected devices.

Affected products

Vendor	Product	Affected	Fixed
BUFFALO	WXR-5700AX7S	firmware Ver. 1.27 and earlier	—
BUFFALO	WXR-5700AX7B	firmware Ver. 1.27 and earlier	—
BUFFALO	WSR-3200AX4S	firmware Ver. 1.26 and earlier	—
BUFFALO	WSR-3200AX4B	firmware Ver. 1.25	—
BUFFALO	WSR-2533DHP	firmware Ver. 1.08 and earlier	—
BUFFALO	WSR-2533DHP2	firmware Ver. 1.22 and earlier	—
BUFFALO	WSR-A2533DHP2	firmware Ver. 1.22 and earlier	—
BUFFALO	WSR-2533DHP3	firmware Ver. 1.26 and earlier	—
BUFFALO	WSR-A2533DHP3	firmware Ver. 1.26 and earlier	—
BUFFALO	WSR-2533DHPL	firmware Ver. 1.08 and earlier	—
BUFFALO	WSR-2533DHPL2	firmware Ver. 1.03 and earlier	—
BUFFALO	WSR-2533DHPLS	firmware Ver. 1.07 and earlier	—
BUFFALO	WSR-2533DHPLB	firmware Ver. 1.05	—
BUFFALO	WCR-1166DS	firmware Ver. 1.34 and earlier	—
BUFFALO	WEX-1800AX4	firmware Ver. 1.13 and earlier	—
BUFFALO	WEX-1800AX4EA	firmware Ver. 1.13 and earlier	—

References