Description
OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected product from the product's specific management page, an arbitrary OS command may be executed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| BUFFALO | WHR-1166DHP2 | Ver. 2.95 and earlier | — |
| BUFFALO | WHR-1166DHP3 | Ver. 2.95 and earlier | — |
| BUFFALO | WHR-1166DHP4 | Ver. 2.95 and earlier | — |
| BUFFALO | WSR-1166DHP3 | Ver. 1.18 and earlier | — |
| BUFFALO | WSR-600DHP | Ver. 2.93 and earlier | — |
| BUFFALO | WEX-300HPTX/N | Ver. 1.02 and earlier | — |
| BUFFALO | WEX-733DHP2 | Ver. 1.03 and earlier | — |
| BUFFALO | WEX-1166DHP2 | Ver. 1.05 and earlier | — |
| BUFFALO | WEX-1166DHPS | Ver. 1.05 and earlier | — |
| BUFFALO | WEX-300HPS/N | Ver. 1.02 and earlier | — |
| BUFFALO | WEX-733DHPS | Ver. 1.02 and earlier | — |
| BUFFALO | WEX-733DHPTX | Ver. 1.03 and earlier | — |
| BUFFALO | WEX-1166DHP | Ver. 1.23 and earlier | — |
| BUFFALO | WEX-733DHP | Ver. 1.64 and earlier | — |
| BUFFALO | WHR-1166DHP | Ver. 2.92 and earlier | — |
| BUFFALO | WHR-300HP2 | Ver. 2.51 and earlier | — |
| BUFFALO | WHR-600D | Ver. 2.91 and earlier | — |
| BUFFALO | WMR-300 | Ver. 2.50 and earlier | — |