Vulnerabilites related to buffalo - wsr-a2533dhp3
Vulnerability from fkie_nvd
Published
2022-12-19 03:15
Modified
2024-11-21 07:26
Severity ?
Summary
Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected devices.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-3200ax4s_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "07164878-06B0-49DB-88D9-C149D72E67C4",
"versionEndIncluding": "1.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-3200ax4s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE5277EC-9BD1-40C3-B1B9-C67A1C45645C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-3200ax4b_firmware:1.25:*:*:*:*:*:*:*",
"matchCriteriaId": "30621C77-BB74-4862-A145-02113D009BF7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-3200ax4b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6BC6F897-46FE-4629-80EC-2740FBA080FF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-2533dhp2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0A8060FF-BC01-493F-8C6A-367B6532CED1",
"versionEndIncluding": "1.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-2533dhp2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "08F476D3-8329-44B1-A2B0-B2AEB500863F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-a2533dhp2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9EA7A67F-30F3-422E-9070-A2EA6353457E",
"versionEndIncluding": "1.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-a2533dhp2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9BF474D3-21B8-47D5-BC18-443295C51638",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-2533dhp3_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C1259443-53C8-4787-B427-81FD177E68A1",
"versionEndIncluding": "1.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-2533dhp3:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE0A99BA-2724-4F68-94F7-8825A0588E6F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-a2533dhp3_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "70BDFC2C-E148-4485-B2E6-33CA2276F751",
"versionEndIncluding": "1.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-a2533dhp3:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B82FF3D2-7ACF-4121-AF92-4A0714EB0C7F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-2533dhpl2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "093EA797-1F83-4FAA-935E-31F8C9986857",
"versionEndIncluding": "1.03",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-2533dhpl2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "31E5BEB1-FCA6-49E9-A244-7AE3DDF83373",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-2533dhpls_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "387619C1-3F85-43DC-A4B1-FF24E2AD8382",
"versionEndIncluding": "1.07",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-2533dhpls:-:*:*:*:*:*:*:*",
"matchCriteriaId": "310ACFB8-13EE-4A72-A9A0-3BFDAFF1ED1A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wex-1800ax4_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "34FE69C5-AC26-4839-9495-3D6F9E34C20B",
"versionEndIncluding": "1.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wex-1800ax4:-:*:*:*:*:*:*:*",
"matchCriteriaId": "751FA556-DDEC-4A69-A6F7-4959FAF6A5C8",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wex-1800ax4ea_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C04C137D-C6A9-4FC6-AEF0-5F42E16B46E8",
"versionEndIncluding": "1.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wex-1800ax4ea:-:*:*:*:*:*:*:*",
"matchCriteriaId": "81507AF7-B640-4695-A095-20ADFD197C66",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-2533dhp_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "366FE02C-D030-4D36-B9C4-167A58D38174",
"versionEndIncluding": "1.08",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-2533dhp:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1574DB7C-A19C-45B5-AD37-4C0AFE8CC798",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-2533dhpl_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "14367351-45B7-460E-80C2-D72609245466",
"versionEndIncluding": "1.08",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-2533dhpl:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C23EE312-9ADE-4B0B-B7ED-F61AC441E5DB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wcr-1166ds_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EE85F7D6-76DB-47C6-BB61-1572B53E8D48",
"versionEndIncluding": "1.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wcr-1166ds:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F5537A90-A060-4CB4-8912-D7994AE75196",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected devices."
},
{
"lang": "es",
"value": "Vulnerabilidad de funcionalidad oculta en dispositivos de red Buffalo WSR-3200AX4S firmware Ver. 1.26 y anteriores, versi\u00f3n del firmware WSR-3200AX4B. 1.25, versi\u00f3n del firmware WSR-2533DHP. 1.08 y anteriores, versi\u00f3n del firmware WSR-2533DHP2. 1.22 y anteriores, versi\u00f3n del firmware WSR-A2533DHP2. 1.22 y anteriores, versi\u00f3n del firmware WSR-2533DHP3. 1.26 y anteriores, versi\u00f3n del firmware WSR-A2533DHP3. 1.26 y anteriores, versi\u00f3n del firmware WSR-2533DHPL. 1.08 y anteriores, versi\u00f3n del firmware WSR-2533DHPL2. 1.03 y anteriores, versi\u00f3n del firmware WSR-2533DHPLS. 1.07 y anteriores, versi\u00f3n del firmware WCR-1166DS. 1.34 y anteriores, versi\u00f3n del firmware WEX-1800AX4. 1.13 y anteriores, y la versi\u00f3n del firmware WEX-1800AX4EA. 1.13 y versiones anteriores permiten que un atacante adyacente a la red con privilegios administrativos habilite las funcionalidades de depuraci\u00f3n y ejecute un comando arbitrario en el dispositivo afectado."
}
],
"id": "CVE-2022-43486",
"lastModified": "2024-11-21T07:26:35.120",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-12-19T03:15:10.633",
"references": [
{
"source": "vultures@jpcert.or.jp",
"url": "https://jvn.jp/en/vu/JVNVU97099584/"
},
{
"source": "vultures@jpcert.or.jp",
"url": "https://www.buffalo.jp/news/detail/20240131-01.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://jvn.jp/en/vu/JVNVU97099584/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.buffalo.jp/news/detail/20240131-01.html"
}
],
"sourceIdentifier": "vultures@jpcert.or.jp",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-12-19 03:15
Modified
2024-11-21 07:26
Severity ?
Summary
OS command injection vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS command if a specially crafted request is sent to a specific CGI program.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-3200ax4s_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "07164878-06B0-49DB-88D9-C149D72E67C4",
"versionEndIncluding": "1.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-3200ax4s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE5277EC-9BD1-40C3-B1B9-C67A1C45645C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-3200ax4b_firmware:1.25:*:*:*:*:*:*:*",
"matchCriteriaId": "30621C77-BB74-4862-A145-02113D009BF7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-3200ax4b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6BC6F897-46FE-4629-80EC-2740FBA080FF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-2533dhp2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0A8060FF-BC01-493F-8C6A-367B6532CED1",
"versionEndIncluding": "1.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-2533dhp2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "08F476D3-8329-44B1-A2B0-B2AEB500863F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-a2533dhp2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9EA7A67F-30F3-422E-9070-A2EA6353457E",
"versionEndIncluding": "1.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-a2533dhp2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9BF474D3-21B8-47D5-BC18-443295C51638",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-2533dhp3_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C1259443-53C8-4787-B427-81FD177E68A1",
"versionEndIncluding": "1.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-2533dhp3:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE0A99BA-2724-4F68-94F7-8825A0588E6F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-a2533dhp3_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "70BDFC2C-E148-4485-B2E6-33CA2276F751",
"versionEndIncluding": "1.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-a2533dhp3:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B82FF3D2-7ACF-4121-AF92-4A0714EB0C7F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-2533dhpl2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "093EA797-1F83-4FAA-935E-31F8C9986857",
"versionEndIncluding": "1.03",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-2533dhpl2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "31E5BEB1-FCA6-49E9-A244-7AE3DDF83373",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-2533dhpls_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "387619C1-3F85-43DC-A4B1-FF24E2AD8382",
"versionEndIncluding": "1.07",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-2533dhpls:-:*:*:*:*:*:*:*",
"matchCriteriaId": "310ACFB8-13EE-4A72-A9A0-3BFDAFF1ED1A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wex-1800ax4_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "34FE69C5-AC26-4839-9495-3D6F9E34C20B",
"versionEndIncluding": "1.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wex-1800ax4:-:*:*:*:*:*:*:*",
"matchCriteriaId": "751FA556-DDEC-4A69-A6F7-4959FAF6A5C8",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wex-1800ax4ea_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C04C137D-C6A9-4FC6-AEF0-5F42E16B46E8",
"versionEndIncluding": "1.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wex-1800ax4ea:-:*:*:*:*:*:*:*",
"matchCriteriaId": "81507AF7-B640-4695-A095-20ADFD197C66",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OS command injection vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS command if a specially crafted request is sent to a specific CGI program."
},
{
"lang": "es",
"value": "Dispositivos de red Buffalo WSR-3200AX4S firmware Ver. 1.26 y anteriores, versi\u00f3n del firmware WSR-3200AX4B. 1.25, versi\u00f3n del firmware WSR-2533DHP2. 1.22 y anteriores, versi\u00f3n del firmware WSR-A2533DHP2. 1.22 y anteriores, versi\u00f3n del firmware WSR-2533DHP3. 1.26 y anteriores, versi\u00f3n del firmware WSR-A2533DHP3. 1.26 y anteriores, versi\u00f3n del firmware WSR-2533DHPL2. 1.03 y anteriores, versi\u00f3n del firmware WSR-2533DHPLS. 1.07 y anteriores, versi\u00f3n del firmware WEX-1800AX4. 1.13 y anteriores, y la versi\u00f3n del firmware WEX-1800AX4EA. 1.13 y anteriores permiten a un atacante adyacente a la red con privilegios administrativos ejecutar un comando arbitrario del sistema operativo si se env\u00eda una solicitud especialmente manipulada a un programa CGI espec\u00edfico."
}
],
"id": "CVE-2022-43466",
"lastModified": "2024-11-21T07:26:32.733",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-12-19T03:15:10.577",
"references": [
{
"source": "vultures@jpcert.or.jp",
"url": "https://jvn.jp/en/vu/JVNVU97099584/"
},
{
"source": "vultures@jpcert.or.jp",
"url": "https://www.buffalo.jp/news/detail/20240131-01.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://jvn.jp/en/vu/JVNVU97099584/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.buffalo.jp/news/detail/20240131-01.html"
}
],
"sourceIdentifier": "vultures@jpcert.or.jp",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-12-19 03:15
Modified
2024-11-21 07:26
Severity ?
Summary
OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted request is sent to the management page.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-3200ax4s_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "07164878-06B0-49DB-88D9-C149D72E67C4",
"versionEndIncluding": "1.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-3200ax4s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE5277EC-9BD1-40C3-B1B9-C67A1C45645C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-3200ax4b_firmware:1.25:*:*:*:*:*:*:*",
"matchCriteriaId": "30621C77-BB74-4862-A145-02113D009BF7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-3200ax4b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6BC6F897-46FE-4629-80EC-2740FBA080FF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-2533dhp2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0A8060FF-BC01-493F-8C6A-367B6532CED1",
"versionEndIncluding": "1.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-2533dhp2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "08F476D3-8329-44B1-A2B0-B2AEB500863F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-a2533dhp2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9EA7A67F-30F3-422E-9070-A2EA6353457E",
"versionEndIncluding": "1.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-a2533dhp2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9BF474D3-21B8-47D5-BC18-443295C51638",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-2533dhp3_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C1259443-53C8-4787-B427-81FD177E68A1",
"versionEndIncluding": "1.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-2533dhp3:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AE0A99BA-2724-4F68-94F7-8825A0588E6F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-a2533dhp3_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "70BDFC2C-E148-4485-B2E6-33CA2276F751",
"versionEndIncluding": "1.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-a2533dhp3:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B82FF3D2-7ACF-4121-AF92-4A0714EB0C7F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-2533dhpl2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "093EA797-1F83-4FAA-935E-31F8C9986857",
"versionEndIncluding": "1.03",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-2533dhpl2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "31E5BEB1-FCA6-49E9-A244-7AE3DDF83373",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-2533dhpls_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "387619C1-3F85-43DC-A4B1-FF24E2AD8382",
"versionEndIncluding": "1.07",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-2533dhpls:-:*:*:*:*:*:*:*",
"matchCriteriaId": "310ACFB8-13EE-4A72-A9A0-3BFDAFF1ED1A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-2533dhp_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "366FE02C-D030-4D36-B9C4-167A58D38174",
"versionEndIncluding": "1.08",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-2533dhp:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1574DB7C-A19C-45B5-AD37-4C0AFE8CC798",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wsr-2533dhpl_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "14367351-45B7-460E-80C2-D72609245466",
"versionEndIncluding": "1.08",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wsr-2533dhpl:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C23EE312-9ADE-4B0B-B7ED-F61AC441E5DB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:buffalo:wcr-1166ds_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EE85F7D6-76DB-47C6-BB61-1572B53E8D48",
"versionEndIncluding": "1.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:buffalo:wcr-1166ds:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F5537A90-A060-4CB4-8912-D7994AE75196",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted request is sent to the management page."
},
{
"lang": "es",
"value": "Dispositivos de red Buffalo WSR-3200AX4S firmware Ver. 1.26 y anteriores, versi\u00f3n del firmware WSR-3200AX4B. 1.25, versi\u00f3n del firmware WSR-2533DHP. 1.08 y anteriores, versi\u00f3n del firmware WSR-2533DHP2. 1.22 y anteriores, versi\u00f3n del firmware WSR-A2533DHP2. 1.22 y anteriores, versi\u00f3n del firmware WSR-2533DHP3. 1.26 y anteriores, versi\u00f3n del firmware WSR-A2533DHP3. 1.26 y anteriores, versi\u00f3n del firmware WSR-2533DHPL. 1.08 y anteriores, versi\u00f3n del firmware WSR-2533DHPL2. 1.03 y anteriores, versi\u00f3n del firmware WSR-2533DHPLS. 1.07 y anteriores, y la versi\u00f3n del firmware WCR-1166DS. 1.34 y anteriores permiten a un atacante adyacente a la red ejecutar un comando arbitrario del sistema operativo si se env\u00eda una solicitud especialmente manipulada a la p\u00e1gina de administraci\u00f3n."
}
],
"id": "CVE-2022-43443",
"lastModified": "2024-11-21T07:26:30.017",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-12-19T03:15:10.517",
"references": [
{
"source": "vultures@jpcert.or.jp",
"url": "https://jvn.jp/en/vu/JVNVU97099584/"
},
{
"source": "vultures@jpcert.or.jp",
"url": "https://www.buffalo.jp/news/detail/20240131-01.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://jvn.jp/en/vu/JVNVU97099584/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.buffalo.jp/news/detail/20240131-01.html"
}
],
"sourceIdentifier": "vultures@jpcert.or.jp",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
cve-2022-43466
Vulnerability from cvelistv5
Published
2022-12-19 00:00
Modified
2024-08-03 13:32
Severity ?
EPSS score ?
Summary
OS command injection vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS command if a specially crafted request is sent to a specific CGI program.
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | BUFFALO INC. | WXR-5700AX7S |
Version: firmware Ver. 1.27 and earlier |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:32:59.511Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.buffalo.jp/news/detail/20240131-01.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU97099584/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "WXR-5700AX7S",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.27 and earlier"
}
]
},
{
"product": "WXR-5700AX7B",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.27 and earlier"
}
]
},
{
"product": "WSR-3200AX4S",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.26 and earlier"
}
]
},
{
"product": "WSR-3200AX4B",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.25"
}
]
},
{
"product": "WSR-2533DHP2",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.22 and earlier"
}
]
},
{
"product": "WSR-A2533DHP2",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.22 and earlier"
}
]
},
{
"product": "WSR-2533DHP3",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.26 and earlier"
}
]
},
{
"product": "WSR-A2533DHP3",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.26 and earlier"
}
]
},
{
"product": "WSR-2533DHPL2",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.03 and earlier"
}
]
},
{
"product": "WSR-2533DHPLS",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.07 and earlier"
}
]
},
{
"product": "WSR-2533DHPLB",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.05"
}
]
},
{
"product": "WEX-1800AX4",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.13 and earlier"
}
]
},
{
"product": "WEX-1800AX4EA",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.13 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OS command injection vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS command if a specially crafted request is sent to a specific CGI program."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "OS command injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-14T06:43:10.641Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.buffalo.jp/news/detail/20240131-01.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU97099584/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2022-43466",
"datePublished": "2022-12-19T00:00:00",
"dateReserved": "2022-12-05T00:00:00",
"dateUpdated": "2024-08-03T13:32:59.511Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-43486
Vulnerability from cvelistv5
Published
2022-12-19 00:00
Modified
2024-08-03 13:32
Severity ?
EPSS score ?
Summary
Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected devices.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | BUFFALO INC. | WXR-5700AX7S |
Version: firmware Ver. 1.27 and earlier |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:32:59.550Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.buffalo.jp/news/detail/20240131-01.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU97099584/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "WXR-5700AX7S",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.27 and earlier"
}
]
},
{
"product": "WXR-5700AX7B",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.27 and earlier"
}
]
},
{
"product": "WSR-3200AX4S",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.26 and earlier"
}
]
},
{
"product": "WSR-3200AX4B",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.25"
}
]
},
{
"product": "WSR-2533DHP",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.08 and earlier"
}
]
},
{
"product": "WSR-2533DHP2",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.22 and earlier"
}
]
},
{
"product": "WSR-A2533DHP2",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.22 and earlier"
}
]
},
{
"product": "WSR-2533DHP3",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.26 and earlier"
}
]
},
{
"product": "WSR-A2533DHP3",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.26 and earlier"
}
]
},
{
"product": "WSR-2533DHPL",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.08 and earlier"
}
]
},
{
"product": "WSR-2533DHPL2",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.03 and earlier"
}
]
},
{
"product": "WSR-2533DHPLS",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.07 and earlier"
}
]
},
{
"product": "WSR-2533DHPLB",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.05"
}
]
},
{
"product": "WCR-1166DS",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.34 and earlier"
}
]
},
{
"product": "WEX-1800AX4",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.13 and earlier"
}
]
},
{
"product": "WEX-1800AX4EA",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.13 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected devices."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Hidden Functionality",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-14T06:44:41.723Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.buffalo.jp/news/detail/20240131-01.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU97099584/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2022-43486",
"datePublished": "2022-12-19T00:00:00",
"dateReserved": "2022-12-05T00:00:00",
"dateUpdated": "2024-08-03T13:32:59.550Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-43443
Vulnerability from cvelistv5
Published
2022-12-19 00:00
Modified
2024-08-03 13:32
Severity ?
EPSS score ?
Summary
OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted request is sent to the management page.
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | BUFFALO INC. | WXR-11000XE12 |
Version: firmware Ver. 1.10 and earlier |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:32:59.565Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.buffalo.jp/news/detail/20240131-01.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU97099584/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "WXR-11000XE12",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.10 and earlier"
}
]
},
{
"product": "WXR-5700AX7S",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.27 and earlier"
}
]
},
{
"product": "WXR-5700AX7B",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.27 and earlier"
}
]
},
{
"product": "WSR-3200AX4S",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.26 and earlier"
}
]
},
{
"product": "WSR-3200AX4B",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.25"
}
]
},
{
"product": "WSR-2533DHP",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.08 and earlier"
}
]
},
{
"product": "WSR-2533DHP2",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.22 and earlier"
}
]
},
{
"product": "WSR-A2533DHP2",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.22 and earlier"
}
]
},
{
"product": "WSR-2533DHP3",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.26 and earlier"
}
]
},
{
"product": "WSR-A2533DHP3",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.26 and earlier"
}
]
},
{
"product": "WSR-2533DHPL",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.08 and earlier"
}
]
},
{
"product": "WSR-2533DHPL2",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.03 and earlier"
}
]
},
{
"product": "WSR-2533DHPLS",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.07 and earlier"
}
]
},
{
"product": "WSR-2533DHPLB",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.05"
}
]
},
{
"product": "WSR-1166DHP",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.16 and earlier"
}
]
},
{
"product": "WSR-1166DHP2",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.17 and earlier"
}
]
},
{
"product": "WCR-1166DS",
"vendor": "BUFFALO INC.",
"versions": [
{
"status": "affected",
"version": "firmware Ver. 1.34 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted request is sent to the management page."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "OS command injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-14T06:43:57.911Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.buffalo.jp/news/detail/20240131-01.html"
},
{
"url": "https://jvn.jp/en/vu/JVNVU97099584/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2022-43443",
"datePublished": "2022-12-19T00:00:00",
"dateReserved": "2022-12-05T00:00:00",
"dateUpdated": "2024-08-03T13:32:59.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
var-202212-0950
Vulnerability from variot
OS command injection vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS command if a specially crafted request is sent to a specific CGI program. Multiple network devices provided by BUFFALO CORPORATION contain the following vulnerabilities. Reporter : Zero Zero One Co., Ltd. Hayakawa Soraya MrThe expected impact depends on each vulnerability, but it may be affected as follows. - CVE-2022-43466 It was * Arbitrary commands are executed when a specially crafted request is sent to the management screen by a third party who has access to the device. - CVE-2022-43443 It was * A third party who can log in to the management screen of the device illegally activates the debugging function and executes arbitrary commands. - CVE-2022-43486. Buffalo network devices WSR-3200AX4S firmware Ver. 1.26 and previous versions, WSR-3200AX4B firmware Ver. 1.25, WSR-2533DHP2 firmware Ver. 1.22 and previous versions, WSR-A2533DHP2 firmware Ver. 1.22 and previous versions, WSR-2533DHP3 firmware Ver. 1.26 and previous versions, WSR-A2533DHP3 firmware Ver. 1.26 and previous versions, WSR-2533DHPL2 firmware Ver. 1.03 and previous versions, WSR-2533DHPLS firmware Ver. 1.07 and previous versions, WEX-1800AX4 firmware Ver. 1.13 and previous versions, and WEX-1800AX4EA firmware Ver
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202212-0950",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wsr-3200ax4s",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.26"
},
{
"model": "wsr-3200ax4b",
"scope": "eq",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.25"
},
{
"model": "wsr-a2533dhp2",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.22"
},
{
"model": "wsr-2533dhpls",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.07"
},
{
"model": "wex-1800ax4",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.13"
},
{
"model": "wsr-2533dhpl2",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.03"
},
{
"model": "wsr-2533dhp2",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.22"
},
{
"model": "wex-1800ax4ea",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.13"
},
{
"model": "wsr-2533dhp3",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.26"
},
{
"model": "wsr-a2533dhp3",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.26"
},
{
"model": "wsr-2533dhpl2",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-2533dhplb",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-2533dhpl",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wxr-5700ax7b",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-a2533dhp2",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-2533dhpls",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-3200ax4b",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wcr-1166ds",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wex-1800ax4ea",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-2533dhp3",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-2533dhp",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wex-1800ax4",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wxr-5700ax7s",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-3200ax4s",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-a2533dhp3",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-1166dhp2",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wxr-11000xe12",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-2533dhp2",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "NVD",
"id": "CVE-2022-43466"
}
]
},
"cve": "CVE-2022-43466",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 0.9,
"id": "CVE-2022-43466",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "OTHER",
"availabilityImpact": "Low",
"baseScore": 4.3,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "JVNDB-2022-002775",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "High",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2022-43466",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "OTHER",
"id": "JVNDB-2022-002775",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-202212-2830",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-2830"
},
{
"db": "NVD",
"id": "CVE-2022-43466"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "OS command injection vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS command if a specially crafted request is sent to a specific CGI program. Multiple network devices provided by BUFFALO CORPORATION contain the following vulnerabilities. Reporter : Zero Zero One Co., Ltd. Hayakawa Soraya MrThe expected impact depends on each vulnerability, but it may be affected as follows. - CVE-2022-43466 It was * Arbitrary commands are executed when a specially crafted request is sent to the management screen by a third party who has access to the device. - CVE-2022-43443 It was * A third party who can log in to the management screen of the device illegally activates the debugging function and executes arbitrary commands. - CVE-2022-43486. Buffalo network devices WSR-3200AX4S firmware Ver. 1.26 and previous versions, WSR-3200AX4B firmware Ver. 1.25, WSR-2533DHP2 firmware Ver. 1.22 and previous versions, WSR-A2533DHP2 firmware Ver. 1.22 and previous versions, WSR-2533DHP3 firmware Ver. 1.26 and previous versions, WSR-A2533DHP3 firmware Ver. 1.26 and previous versions, WSR-2533DHPL2 firmware Ver. 1.03 and previous versions, WSR-2533DHPLS firmware Ver. 1.07 and previous versions, WEX-1800AX4 firmware Ver. 1.13 and previous versions, and WEX-1800AX4EA firmware Ver",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-43466"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "VULMON",
"id": "CVE-2022-43466"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "JVN",
"id": "JVNVU97099584",
"trust": 2.5
},
{
"db": "NVD",
"id": "CVE-2022-43466",
"trust": 2.5
},
{
"db": "JVNDB",
"id": "JVNDB-2022-002775",
"trust": 1.4
},
{
"db": "CNNVD",
"id": "CNNVD-202212-2830",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2022-43466",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2022-43466"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-2830"
},
{
"db": "NVD",
"id": "CVE-2022-43466"
}
]
},
"id": "VAR-202212-0950",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.6166666666666667
},
"last_update_date": "2024-08-14T15:16:20.565000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Buffalo Co., Ltd. \u00a0 announcement page",
"trust": 0.8,
"url": "https://www.buffalo.jp/news/detail/20221205-01.html"
},
{
"title": "Buffalo network devices Fixes for operating system command injection vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=219179"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-2830"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-78",
"trust": 1.0
},
{
"problemtype": "OS Command injection (CWE-78) [ others ]",
"trust": 0.8
},
{
"problemtype": " Unpublished features (CWE-912) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "NVD",
"id": "CVE-2022-43466"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.0,
"url": "https://jvn.jp/en/vu/jvnvu97099584/"
},
{
"trust": 1.0,
"url": "https://www.buffalo.jp/news/detail/20240131-01.html"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu97099584/index.html"
},
{
"trust": 0.7,
"url": "https://jvn.jp/en/vu/jvnvu97099584/index.html"
},
{
"trust": 0.7,
"url": "https://www.buffalo.jp/news/detail/20221205-01.html"
},
{
"trust": 0.6,
"url": "https://jvndb.jvn.jp/en/contents/2022/jvndb-2022-002775.html"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-43466/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2022-43466"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-2830"
},
{
"db": "NVD",
"id": "CVE-2022-43466"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULMON",
"id": "CVE-2022-43466"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-2830"
},
{
"db": "NVD",
"id": "CVE-2022-43466"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-12-19T00:00:00",
"db": "VULMON",
"id": "CVE-2022-43466"
},
{
"date": "2022-12-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"date": "2022-12-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202212-2830"
},
{
"date": "2022-12-19T03:15:10.577000",
"db": "NVD",
"id": "CVE-2022-43466"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-12-19T00:00:00",
"db": "VULMON",
"id": "CVE-2022-43466"
},
{
"date": "2024-02-14T06:39:00",
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"date": "2022-12-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202212-2830"
},
{
"date": "2024-02-14T07:15:08.567000",
"db": "NVD",
"id": "CVE-2022-43466"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202212-2830"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple vulnerabilities in Buffalo network equipment",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "operating system commend injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202212-2830"
}
],
"trust": 0.6
}
}
var-202212-0948
Vulnerability from variot
Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected devices. Multiple network devices provided by BUFFALO CORPORATION contain the following vulnerabilities. * OS Command injection (CWE-78) - CVE-2022-43466 It was * OS Command injection (CWE-78) - CVE-2022-43443 It was * Issue with enabling undocumented debugging features (CWE-912) - CVE-2022-43486 This vulnerability information is JPCERT/CC Report to JPCERT/CC Coordinated with the developer. Reporter : Zero Zero One Co., Ltd. Hayakawa Soraya MrThe expected impact depends on each vulnerability, but it may be affected as follows. It was * A third party who can log into the management screen of the device may CGI When a specially crafted request is sent to a program, arbitrary commands are executed when a specific management screen is opened. - CVE-2022-43466 It was * Arbitrary commands are executed when a specially crafted request is sent to the management screen by a third party who has access to the device. - CVE-2022-43443 It was * A third party who can log in to the management screen of the device illegally activates the debugging function and executes arbitrary commands. - CVE-2022-43486. 1.26 and previous versions, WSR-3200AX4B firmware Ver. 1.25, WSR-2533DHP firmware Ver. 1.08 and previous versions, WSR-2533DHP2 firmware Ver. 1.22 and previous versions, WSR-A2533DHP2 firmware Ver. 1.22 and previous versions, WSR-2533DHP3 firmware Ver. 1.26 and previous versions, WSR-A2533DHP3 firmware Ver. 1.26 and previous versions, WSR-2533DHPL firmware Ver. 1.08 and previous versions, WSR-2533DHPL2 firmware Ver. 1.03 and previous versions, WSR-2533DHPLS firmware Ver. 1.07 and previous versions, WCR-1166DS firmware Ver. 1.34 and previous versions, WEX-1800AX4 firmware Ver. 1.13 and previous versions, and WEX-1800AX4EA firmware Ver
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202212-0948",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wsr-3200ax4s",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.26"
},
{
"model": "wsr-2533dhpl",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.08"
},
{
"model": "wsr-2533dhp",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.08"
},
{
"model": "wcr-1166ds",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.34"
},
{
"model": "wsr-3200ax4b",
"scope": "eq",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.25"
},
{
"model": "wsr-a2533dhp2",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.22"
},
{
"model": "wsr-2533dhpls",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.07"
},
{
"model": "wex-1800ax4",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.13"
},
{
"model": "wsr-2533dhpl2",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.03"
},
{
"model": "wsr-2533dhp2",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.22"
},
{
"model": "wex-1800ax4ea",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.13"
},
{
"model": "wsr-2533dhp3",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.26"
},
{
"model": "wsr-a2533dhp3",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.26"
},
{
"model": "wsr-2533dhpl2",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-2533dhplb",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-2533dhpl",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wxr-5700ax7b",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-a2533dhp2",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-2533dhpls",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-3200ax4b",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wcr-1166ds",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wex-1800ax4ea",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-2533dhp3",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-2533dhp",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wex-1800ax4",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wxr-5700ax7s",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-3200ax4s",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-a2533dhp3",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-1166dhp2",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wxr-11000xe12",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-2533dhp2",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "NVD",
"id": "CVE-2022-43486"
}
]
},
"cve": "CVE-2022-43486",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 0.9,
"id": "CVE-2022-43486",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "OTHER",
"availabilityImpact": "High",
"baseScore": 6.8,
"baseSeverity": "Medium",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2022-002775",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "High",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2022-43486",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "OTHER",
"id": "JVNDB-2022-002775",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-202212-2828",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-2828"
},
{
"db": "NVD",
"id": "CVE-2022-43486"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected devices. Multiple network devices provided by BUFFALO CORPORATION contain the following vulnerabilities. * OS Command injection (CWE-78) - CVE-2022-43466 It was * OS Command injection (CWE-78) - CVE-2022-43443 It was * Issue with enabling undocumented debugging features (CWE-912) - CVE-2022-43486 This vulnerability information is JPCERT/CC Report to JPCERT/CC Coordinated with the developer. Reporter : Zero Zero One Co., Ltd. Hayakawa Soraya MrThe expected impact depends on each vulnerability, but it may be affected as follows. It was * A third party who can log into the management screen of the device may CGI When a specially crafted request is sent to a program, arbitrary commands are executed when a specific management screen is opened. - CVE-2022-43466 It was * Arbitrary commands are executed when a specially crafted request is sent to the management screen by a third party who has access to the device. - CVE-2022-43443 It was * A third party who can log in to the management screen of the device illegally activates the debugging function and executes arbitrary commands. - CVE-2022-43486. 1.26 and previous versions, WSR-3200AX4B firmware Ver. 1.25, WSR-2533DHP firmware Ver. 1.08 and previous versions, WSR-2533DHP2 firmware Ver. 1.22 and previous versions, WSR-A2533DHP2 firmware Ver. 1.22 and previous versions, WSR-2533DHP3 firmware Ver. 1.26 and previous versions, WSR-A2533DHP3 firmware Ver. 1.26 and previous versions, WSR-2533DHPL firmware Ver. 1.08 and previous versions, WSR-2533DHPL2 firmware Ver. 1.03 and previous versions, WSR-2533DHPLS firmware Ver. 1.07 and previous versions, WCR-1166DS firmware Ver. 1.34 and previous versions, WEX-1800AX4 firmware Ver. 1.13 and previous versions, and WEX-1800AX4EA firmware Ver",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-43486"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "VULMON",
"id": "CVE-2022-43486"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "JVN",
"id": "JVNVU97099584",
"trust": 2.5
},
{
"db": "NVD",
"id": "CVE-2022-43486",
"trust": 2.5
},
{
"db": "JVNDB",
"id": "JVNDB-2022-002775",
"trust": 1.4
},
{
"db": "CNNVD",
"id": "CNNVD-202212-2828",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2022-43486",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2022-43486"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-2828"
},
{
"db": "NVD",
"id": "CVE-2022-43486"
}
]
},
"id": "VAR-202212-0948",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.6166666666666667
},
"last_update_date": "2024-08-14T15:16:20.591000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Buffalo Co., Ltd. \u00a0 announcement page",
"trust": 0.8,
"url": "https://www.buffalo.jp/news/detail/20221205-01.html"
},
{
"title": "Buffalo network devices Security vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=218326"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-2828"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "OS Command injection (CWE-78) [ others ]",
"trust": 0.8
},
{
"problemtype": " Unpublished features (CWE-912) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "NVD",
"id": "CVE-2022-43486"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.0,
"url": "https://jvn.jp/en/vu/jvnvu97099584/"
},
{
"trust": 1.0,
"url": "https://www.buffalo.jp/news/detail/20240131-01.html"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu97099584/index.html"
},
{
"trust": 0.7,
"url": "https://jvn.jp/en/vu/jvnvu97099584/index.html"
},
{
"trust": 0.7,
"url": "https://www.buffalo.jp/news/detail/20221205-01.html"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-43486/"
},
{
"trust": 0.6,
"url": "https://jvndb.jvn.jp/en/contents/2022/jvndb-2022-002775.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2022-43486"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-2828"
},
{
"db": "NVD",
"id": "CVE-2022-43486"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULMON",
"id": "CVE-2022-43486"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-2828"
},
{
"db": "NVD",
"id": "CVE-2022-43486"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-12-19T00:00:00",
"db": "VULMON",
"id": "CVE-2022-43486"
},
{
"date": "2022-12-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"date": "2022-12-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202212-2828"
},
{
"date": "2022-12-19T03:15:10.633000",
"db": "NVD",
"id": "CVE-2022-43486"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-12-19T00:00:00",
"db": "VULMON",
"id": "CVE-2022-43486"
},
{
"date": "2024-02-14T06:39:00",
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"date": "2022-12-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202212-2828"
},
{
"date": "2024-02-14T07:15:09.107000",
"db": "NVD",
"id": "CVE-2022-43486"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202212-2828"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple vulnerabilities in Buffalo network equipment",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202212-2828"
}
],
"trust": 0.6
}
}
var-202212-0949
Vulnerability from variot
OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted request is sent to the management page. Multiple network devices provided by BUFFALO CORPORATION contain the following vulnerabilities. Reporter : Zero Zero One Co., Ltd. Hayakawa Soraya MrThe expected impact depends on each vulnerability, but it may be affected as follows. - CVE-2022-43443 It was * A third party who can log in to the management screen of the device illegally activates the debugging function and executes arbitrary commands. - CVE-2022-43486. Buffalo network devices WSR-3200AX4S firmware Ver. 1.26 and previous versions, WSR-3200AX4B firmware Ver. 1.25, WSR-2533DHP firmware Ver. 1.08 and previous versions, WSR-2533DHP2 firmware Ver. 1.22 and previous versions, WSR-A2533DHP2 firmware Ver. 1.22 and previous versions, WSR-2533DHP3 firmware Ver. 1.26 and previous versions, WSR-A2533DHP3 firmware Ver. 1.26 and previous versions, WSR-2533DHPL firmware Ver. 1.08 and previous versions, WSR-2533DHPL2 firmware Ver. 1.03 and previous versions, WSR-2533DHPLS firmware Ver. 1.07 and previous versions, and WCR-1166DS firmware Ver
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202212-0949",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wsr-3200ax4s",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.26"
},
{
"model": "wsr-2533dhpl",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.08"
},
{
"model": "wsr-2533dhp",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.08"
},
{
"model": "wcr-1166ds",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.34"
},
{
"model": "wsr-3200ax4b",
"scope": "eq",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.25"
},
{
"model": "wsr-a2533dhp2",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.22"
},
{
"model": "wsr-2533dhpls",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.07"
},
{
"model": "wsr-2533dhpl2",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.03"
},
{
"model": "wsr-2533dhp2",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.22"
},
{
"model": "wsr-2533dhp3",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.26"
},
{
"model": "wsr-a2533dhp3",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.26"
},
{
"model": "wsr-2533dhpl2",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-2533dhplb",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-2533dhpl",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wxr-5700ax7b",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-a2533dhp2",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-2533dhpls",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-3200ax4b",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wcr-1166ds",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wex-1800ax4ea",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-2533dhp3",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-2533dhp",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wex-1800ax4",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wxr-5700ax7s",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-3200ax4s",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-a2533dhp3",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-1166dhp2",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wxr-11000xe12",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
},
{
"model": "wsr-2533dhp2",
"scope": null,
"trust": 0.8,
"vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "NVD",
"id": "CVE-2022-43443"
}
]
},
"cve": "CVE-2022-43443",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2022-43443",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "OTHER",
"availabilityImpact": "Low",
"baseScore": 6.3,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "JVNDB-2022-002775",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2022-43443",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "OTHER",
"id": "JVNDB-2022-002775",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-202212-2829",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-2829"
},
{
"db": "NVD",
"id": "CVE-2022-43443"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted request is sent to the management page. Multiple network devices provided by BUFFALO CORPORATION contain the following vulnerabilities. Reporter : Zero Zero One Co., Ltd. Hayakawa Soraya MrThe expected impact depends on each vulnerability, but it may be affected as follows. - CVE-2022-43443 It was * A third party who can log in to the management screen of the device illegally activates the debugging function and executes arbitrary commands. - CVE-2022-43486. Buffalo network devices WSR-3200AX4S firmware Ver. 1.26 and previous versions, WSR-3200AX4B firmware Ver. 1.25, WSR-2533DHP firmware Ver. 1.08 and previous versions, WSR-2533DHP2 firmware Ver. 1.22 and previous versions, WSR-A2533DHP2 firmware Ver. 1.22 and previous versions, WSR-2533DHP3 firmware Ver. 1.26 and previous versions, WSR-A2533DHP3 firmware Ver. 1.26 and previous versions, WSR-2533DHPL firmware Ver. 1.08 and previous versions, WSR-2533DHPL2 firmware Ver. 1.03 and previous versions, WSR-2533DHPLS firmware Ver. 1.07 and previous versions, and WCR-1166DS firmware Ver",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-43443"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "VULMON",
"id": "CVE-2022-43443"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "JVN",
"id": "JVNVU97099584",
"trust": 2.5
},
{
"db": "NVD",
"id": "CVE-2022-43443",
"trust": 2.5
},
{
"db": "JVNDB",
"id": "JVNDB-2022-002775",
"trust": 1.4
},
{
"db": "CNNVD",
"id": "CNNVD-202212-2829",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2022-43443",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2022-43443"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-2829"
},
{
"db": "NVD",
"id": "CVE-2022-43443"
}
]
},
"id": "VAR-202212-0949",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.6166666666666667
},
"last_update_date": "2024-08-14T15:16:20.540000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Buffalo Co., Ltd. \u00a0 announcement page",
"trust": 0.8,
"url": "https://www.buffalo.jp/news/detail/20221205-01.html"
},
{
"title": "Buffalo network devices Fixes for operating system command injection vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=219178"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-2829"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-78",
"trust": 1.0
},
{
"problemtype": "OS Command injection (CWE-78) [ others ]",
"trust": 0.8
},
{
"problemtype": " Unpublished features (CWE-912) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "NVD",
"id": "CVE-2022-43443"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.0,
"url": "https://jvn.jp/en/vu/jvnvu97099584/"
},
{
"trust": 1.0,
"url": "https://www.buffalo.jp/news/detail/20240131-01.html"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu97099584/index.html"
},
{
"trust": 0.7,
"url": "https://jvn.jp/en/vu/jvnvu97099584/index.html"
},
{
"trust": 0.7,
"url": "https://www.buffalo.jp/news/detail/20221205-01.html"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-43443/"
},
{
"trust": 0.6,
"url": "https://jvndb.jvn.jp/en/contents/2022/jvndb-2022-002775.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2022-43443"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-2829"
},
{
"db": "NVD",
"id": "CVE-2022-43443"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULMON",
"id": "CVE-2022-43443"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"db": "CNNVD",
"id": "CNNVD-202212-2829"
},
{
"db": "NVD",
"id": "CVE-2022-43443"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-12-19T00:00:00",
"db": "VULMON",
"id": "CVE-2022-43443"
},
{
"date": "2022-12-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"date": "2022-12-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202212-2829"
},
{
"date": "2022-12-19T03:15:10.517000",
"db": "NVD",
"id": "CVE-2022-43443"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-12-19T00:00:00",
"db": "VULMON",
"id": "CVE-2022-43443"
},
{
"date": "2024-02-14T06:39:00",
"db": "JVNDB",
"id": "JVNDB-2022-002775"
},
{
"date": "2022-12-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202212-2829"
},
{
"date": "2024-02-14T07:15:08.110000",
"db": "NVD",
"id": "CVE-2022-43443"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202212-2829"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple vulnerabilities in Buffalo network equipment",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-002775"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "operating system commend injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202212-2829"
}
],
"trust": 0.6
}
}