Description
BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execute an arbitrary OS command.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| BUFFALO | WSR-300HP | < Ver.2.55 | Ver.2.55 |
| BUFFALO | WEX-G300 | < Ver.1.71 | Ver.1.71 |