Skip to content
OpenAdvisories
Medium · 4.2 CVE-2024-26023 EUVD-2024-23317GHSA-pj4v-6cqj-7mvr

OS command injection vulnerability in BUFFALO wireless LAN routers allows a logged-in user to execute arbitrary OS commands.

Published Apr 15, 2024 · Updated Aug 1, 2024 · Assigned by jpcert

Vendor: BUFFALO Product: WCR-1166DS Product: WSR-1166DHP Product: WSR-1166DHP2 Product: WSR-2533DHP Product: WSR-2533DHP2 Product: WSR-2533DHPL Product: WSR-A2533DHP2

Description

OS command injection vulnerability in BUFFALO wireless LAN routers allows a logged-in user to execute arbitrary OS commands.

Affected products

VendorProductAffectedFixed
BUFFALO WCR-1166DS firmware Ver. 1.32 and earlier —
BUFFALO WSR-1166DHP firmware Ver. 1.14 and earlier —
BUFFALO WSR-1166DHP2 firmware Ver. 1.14 and earlier —
BUFFALO WSR-2533DHP firmware Ver. 1.06 and earlier —
BUFFALO WSR-2533DHPL firmware Ver. 1.06 and earlier —
BUFFALO WSR-2533DHP2 firmware Ver. 1.10 and earlier —
BUFFALO WSR-A2533DHP2 firmware Ver. 1.10 and earlier —

References