cvelistv5 - cve-2024-44072

cve-2024-44072

Vulnerability from cvelistv5

Published

2024-09-10 06:56

Modified

2024-09-10 19:58

Severity ?

5.7 (Medium) - CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

Summary

References

▼	URL	Tags
	vultures@jpcert.or.jp	https://jvn.jp/en/jp/JVN12824024/
	vultures@jpcert.or.jp	https://www.buffalo.jp/news/detail/20240719-01.html

Impacted products

Vendor

Product

Version

▼

BUFFALO INC.

WHR-1166DHP2

Version: Ver. 2.95 and earlier

BUFFALO INC.	WHR-1166DHP3	Version: Ver. 2.95 and earlier
BUFFALO INC.	WHR-1166DHP4	Version: Ver. 2.95 and earlier
BUFFALO INC.	WSR-1166DHP3	Version: Ver. 1.18 and earlier
BUFFALO INC.	WSR-600DHP	Version: Ver. 2.93 and earlier
BUFFALO INC.	WEX-300HPTX/N	Version: Ver. 1.02 and earlier
BUFFALO INC.	WEX-733DHP2	Version: Ver. 1.03 and earlier
BUFFALO INC.	WEX-1166DHP2	Version: Ver. 1.05 and earlier
BUFFALO INC.	WEX-1166DHPS	Version: Ver. 1.05 and earlier
BUFFALO INC.	WEX-300HPS/N	Version: Ver. 1.02 and earlier
BUFFALO INC.	WEX-733DHPS	Version: Ver. 1.02 and earlier
BUFFALO INC.	WEX-733DHPTX	Version: Ver. 1.03 and earlier
BUFFALO INC.	WEX-1166DHP	Version: Ver. 1.23 and earlier
BUFFALO INC.	WEX-733DHP	Version: Ver. 1.64 and earlier
BUFFALO INC.	WHR-1166DHP	Version: Ver. 2.92 and earlier
BUFFALO INC.	WHR-300HP2	Version: Ver. 2.51 and earlier
BUFFALO INC.	WHR-600D	Version: Ver. 2.91 and earlier
BUFFALO INC.	WMR-300	Version: Ver. 2.50 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:h:buffalo_inc:whr_1166dhp2:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "whr_1166dhp2",
            "vendor": "buffalo_inc",
            "versions": [
              {
                "lessThanOrEqual": "2.95",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:buffalo_inc:whr_1166dhp3:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "whr_1166dhp3",
            "vendor": "buffalo_inc",
            "versions": [
              {
                "lessThanOrEqual": "2.95",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:buffalo_inc:whr_1166dhp4:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "whr_1166dhp4",
            "vendor": "buffalo_inc",
            "versions": [
              {
                "lessThanOrEqual": "2.95",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:buffalo_inc:wsr_1166dhp3:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wsr_1166dhp3",
            "vendor": "buffalo_inc",
            "versions": [
              {
                "lessThanOrEqual": "1.18",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:buffalo_inc:wsr_600dhp:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wsr_600dhp",
            "vendor": "buffalo_inc",
            "versions": [
              {
                "lessThanOrEqual": "2.93",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:buffalo_inc:wex_300hptxn:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wex_300hptxn",
            "vendor": "buffalo_inc",
            "versions": [
              {
                "lessThanOrEqual": "1.02",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:buffalo_inc:wex_733dhp2:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wex_733dhp2",
            "vendor": "buffalo_inc",
            "versions": [
              {
                "lessThanOrEqual": "1.03",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:buffalo_inc:wex_1166dhp2:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wex_1166dhp2",
            "vendor": "buffalo_inc",
            "versions": [
              {
                "lessThanOrEqual": "1.05",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:buffalo_inc:wex_1166dhps:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wex_1166dhps",
            "vendor": "buffalo_inc",
            "versions": [
              {
                "lessThanOrEqual": "1.05",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:buffalo_inc:wex_300hpsn:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wex_300hpsn",
            "vendor": "buffalo_inc",
            "versions": [
              {
                "lessThanOrEqual": "1.02",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:buffalo_inc:wex_733dhps:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wex_733dhps",
            "vendor": "buffalo_inc",
            "versions": [
              {
                "lessThanOrEqual": "1.02",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:buffalo_inc:wex_733hptx:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wex_733hptx",
            "vendor": "buffalo_inc",
            "versions": [
              {
                "lessThanOrEqual": "1.03",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:buffalo_inc:wex_1166dhp:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wex_1166dhp",
            "vendor": "buffalo_inc",
            "versions": [
              {
                "lessThanOrEqual": "1.23",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:buffalo_inc:wex_733dhp:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wex_733dhp",
            "vendor": "buffalo_inc",
            "versions": [
              {
                "lessThanOrEqual": "1.64",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:buffalo_inc:whr_1166dhp:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "whr_1166dhp",
            "vendor": "buffalo_inc",
            "versions": [
              {
                "lessThanOrEqual": "2.92",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:buffalo_inc:whr_300hp2:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "whr_300hp2",
            "vendor": "buffalo_inc",
            "versions": [
              {
                "lessThanOrEqual": "2.51",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:buffalo_inc:whr_600d:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "whr_600d",
            "vendor": "buffalo_inc",
            "versions": [
              {
                "lessThanOrEqual": "2.91",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:buffalo_inc:wmr_300:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wmr_300",
            "vendor": "buffalo_inc",
            "versions": [
              {
                "lessThanOrEqual": "2.50",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-44072",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T18:57:48.477370Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-78",
                "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-10T19:58:39.140Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WHR-1166DHP2",
          "vendor": "BUFFALO INC.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 2.95 and earlier"
            }
          ]
        },
        {
          "product": "WHR-1166DHP3",
          "vendor": "BUFFALO INC.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 2.95 and earlier"
            }
          ]
        },
        {
          "product": "WHR-1166DHP4",
          "vendor": "BUFFALO INC.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 2.95 and earlier"
            }
          ]
        },
        {
          "product": "WSR-1166DHP3",
          "vendor": "BUFFALO INC.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 1.18 and earlier"
            }
          ]
        },
        {
          "product": "WSR-600DHP",
          "vendor": "BUFFALO INC.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 2.93 and earlier"
            }
          ]
        },
        {
          "product": "WEX-300HPTX/N",
          "vendor": "BUFFALO INC.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 1.02 and earlier"
            }
          ]
        },
        {
          "product": "WEX-733DHP2",
          "vendor": "BUFFALO INC.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 1.03 and earlier"
            }
          ]
        },
        {
          "product": "WEX-1166DHP2",
          "vendor": "BUFFALO INC.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 1.05 and earlier"
            }
          ]
        },
        {
          "product": "WEX-1166DHPS",
          "vendor": "BUFFALO INC.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 1.05 and earlier"
            }
          ]
        },
        {
          "product": "WEX-300HPS/N",
          "vendor": "BUFFALO INC.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 1.02 and earlier"
            }
          ]
        },
        {
          "product": "WEX-733DHPS",
          "vendor": "BUFFALO INC.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 1.02 and earlier"
            }
          ]
        },
        {
          "product": "WEX-733DHPTX",
          "vendor": "BUFFALO INC.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 1.03 and earlier"
            }
          ]
        },
        {
          "product": "WEX-1166DHP",
          "vendor": "BUFFALO INC.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 1.23 and earlier"
            }
          ]
        },
        {
          "product": "WEX-733DHP",
          "vendor": "BUFFALO INC.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 1.64 and earlier"
            }
          ]
        },
        {
          "product": "WHR-1166DHP",
          "vendor": "BUFFALO INC.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 2.92 and earlier"
            }
          ]
        },
        {
          "product": "WHR-300HP2",
          "vendor": "BUFFALO INC.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 2.51 and earlier"
            }
          ]
        },
        {
          "product": "WHR-600D",
          "vendor": "BUFFALO INC.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 2.91 and earlier"
            }
          ]
        },
        {
          "product": "WMR-300",
          "vendor": "BUFFALO INC.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 2.50 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected product from the product\u0027s specific management page, an arbitrary OS command may be executed."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "OS command injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-10T06:56:44.182Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.buffalo.jp/news/detail/20240719-01.html"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN12824024/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-44072",
    "datePublished": "2024-09-10T06:56:44.182Z",
    "dateReserved": "2024-08-19T02:08:40.600Z",
    "dateUpdated": "2024-09-10T19:58:39.140Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-44072\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2024-09-10T07:15:01.963\",\"lastModified\":\"2024-09-10T20:35:09.990\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected product from the product\u0027s specific management page, an arbitrary OS command may be executed.\"},{\"lang\":\"es\",\"value\":\"Existe una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en los enrutadores y repetidores de LAN inal\u00e1mbrica de BUFFALO. Si un usuario inicia sesi\u00f3n en la p\u00e1gina de administraci\u00f3n y env\u00eda una solicitud especialmente manipulada al producto afectado desde la p\u00e1gina de administraci\u00f3n espec\u00edfica del producto, se puede ejecutar un comando arbitrario del sistema operativo.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L\",\"baseScore\":5.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":0.9,\"impactScore\":4.7}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"references\":[{\"url\":\"https://jvn.jp/en/jp/JVN12824024/\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://www.buffalo.jp/news/detail/20240719-01.html\",\"source\":\"vultures@jpcert.or.jp\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.7, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-44072\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T18:57:48.477370Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:h:buffalo_inc:whr_1166dhp2:*:*:*:*:*:*:*:*\"], \"vendor\": \"buffalo_inc\", \"product\": \"whr_1166dhp2\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"2.95\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:h:buffalo_inc:whr_1166dhp3:*:*:*:*:*:*:*:*\"], \"vendor\": \"buffalo_inc\", \"product\": \"whr_1166dhp3\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"2.95\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:h:buffalo_inc:whr_1166dhp4:*:*:*:*:*:*:*:*\"], \"vendor\": \"buffalo_inc\", \"product\": \"whr_1166dhp4\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"2.95\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:h:buffalo_inc:wsr_1166dhp3:*:*:*:*:*:*:*:*\"], \"vendor\": \"buffalo_inc\", \"product\": \"wsr_1166dhp3\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.18\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:h:buffalo_inc:wsr_600dhp:*:*:*:*:*:*:*:*\"], \"vendor\": \"buffalo_inc\", \"product\": \"wsr_600dhp\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"2.93\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:h:buffalo_inc:wex_300hptxn:*:*:*:*:*:*:*:*\"], \"vendor\": \"buffalo_inc\", \"product\": \"wex_300hptxn\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.02\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:h:buffalo_inc:wex_733dhp2:*:*:*:*:*:*:*:*\"], \"vendor\": \"buffalo_inc\", \"product\": \"wex_733dhp2\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.03\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:h:buffalo_inc:wex_1166dhp2:*:*:*:*:*:*:*:*\"], \"vendor\": \"buffalo_inc\", \"product\": \"wex_1166dhp2\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.05\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:h:buffalo_inc:wex_1166dhps:*:*:*:*:*:*:*:*\"], \"vendor\": \"buffalo_inc\", \"product\": \"wex_1166dhps\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.05\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:h:buffalo_inc:wex_300hpsn:*:*:*:*:*:*:*:*\"], \"vendor\": \"buffalo_inc\", \"product\": \"wex_300hpsn\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.02\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:h:buffalo_inc:wex_733dhps:*:*:*:*:*:*:*:*\"], \"vendor\": \"buffalo_inc\", \"product\": \"wex_733dhps\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.02\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:h:buffalo_inc:wex_733hptx:*:*:*:*:*:*:*:*\"], \"vendor\": \"buffalo_inc\", \"product\": \"wex_733hptx\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.03\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:h:buffalo_inc:wex_1166dhp:*:*:*:*:*:*:*:*\"], \"vendor\": \"buffalo_inc\", \"product\": \"wex_1166dhp\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.23\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:h:buffalo_inc:wex_733dhp:*:*:*:*:*:*:*:*\"], \"vendor\": \"buffalo_inc\", \"product\": \"wex_733dhp\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.64\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:h:buffalo_inc:whr_1166dhp:*:*:*:*:*:*:*:*\"], \"vendor\": \"buffalo_inc\", \"product\": \"whr_1166dhp\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"2.92\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:h:buffalo_inc:whr_300hp2:*:*:*:*:*:*:*:*\"], \"vendor\": \"buffalo_inc\", \"product\": \"whr_300hp2\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"2.51\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:h:buffalo_inc:whr_600d:*:*:*:*:*:*:*:*\"], \"vendor\": \"buffalo_inc\", \"product\": \"whr_600d\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"2.91\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:h:buffalo_inc:wmr_300:*:*:*:*:*:*:*:*\"], \"vendor\": \"buffalo_inc\", \"product\": \"wmr_300\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"2.50\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-10T19:02:33.417Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"BUFFALO INC.\", \"product\": \"WHR-1166DHP2\", \"versions\": [{\"status\": \"affected\", \"version\": \"Ver. 2.95 and earlier\"}]}, {\"vendor\": \"BUFFALO INC.\", \"product\": \"WHR-1166DHP3\", \"versions\": [{\"status\": \"affected\", \"version\": \"Ver. 2.95 and earlier\"}]}, {\"vendor\": \"BUFFALO INC.\", \"product\": \"WHR-1166DHP4\", \"versions\": [{\"status\": \"affected\", \"version\": \"Ver. 2.95 and earlier\"}]}, {\"vendor\": \"BUFFALO INC.\", \"product\": \"WSR-1166DHP3\", \"versions\": [{\"status\": \"affected\", \"version\": \"Ver. 1.18 and earlier\"}]}, {\"vendor\": \"BUFFALO INC.\", \"product\": \"WSR-600DHP\", \"versions\": [{\"status\": \"affected\", \"version\": \"Ver. 2.93 and earlier\"}]}, {\"vendor\": \"BUFFALO INC.\", \"product\": \"WEX-300HPTX/N\", \"versions\": [{\"status\": \"affected\", \"version\": \"Ver. 1.02 and earlier\"}]}, {\"vendor\": \"BUFFALO INC.\", \"product\": \"WEX-733DHP2\", \"versions\": [{\"status\": \"affected\", \"version\": \"Ver. 1.03 and earlier\"}]}, {\"vendor\": \"BUFFALO INC.\", \"product\": \"WEX-1166DHP2\", \"versions\": [{\"status\": \"affected\", \"version\": \"Ver. 1.05 and earlier\"}]}, {\"vendor\": \"BUFFALO INC.\", \"product\": \"WEX-1166DHPS\", \"versions\": [{\"status\": \"affected\", \"version\": \"Ver. 1.05 and earlier\"}]}, {\"vendor\": \"BUFFALO INC.\", \"product\": \"WEX-300HPS/N\", \"versions\": [{\"status\": \"affected\", \"version\": \"Ver. 1.02 and earlier\"}]}, {\"vendor\": \"BUFFALO INC.\", \"product\": \"WEX-733DHPS\", \"versions\": [{\"status\": \"affected\", \"version\": \"Ver. 1.02 and earlier\"}]}, {\"vendor\": \"BUFFALO INC.\", \"product\": \"WEX-733DHPTX\", \"versions\": [{\"status\": \"affected\", \"version\": \"Ver. 1.03 and earlier\"}]}, {\"vendor\": \"BUFFALO INC.\", \"product\": \"WEX-1166DHP\", \"versions\": [{\"status\": \"affected\", \"version\": \"Ver. 1.23 and earlier\"}]}, {\"vendor\": \"BUFFALO INC.\", \"product\": \"WEX-733DHP\", \"versions\": [{\"status\": \"affected\", \"version\": \"Ver. 1.64 and earlier\"}]}, {\"vendor\": \"BUFFALO INC.\", \"product\": \"WHR-1166DHP\", \"versions\": [{\"status\": \"affected\", \"version\": \"Ver. 2.92 and earlier\"}]}, {\"vendor\": \"BUFFALO INC.\", \"product\": \"WHR-300HP2\", \"versions\": [{\"status\": \"affected\", \"version\": \"Ver. 2.51 and earlier\"}]}, {\"vendor\": \"BUFFALO INC.\", \"product\": \"WHR-600D\", \"versions\": [{\"status\": \"affected\", \"version\": \"Ver. 2.91 and earlier\"}]}, {\"vendor\": \"BUFFALO INC.\", \"product\": \"WMR-300\", \"versions\": [{\"status\": \"affected\", \"version\": \"Ver. 2.50 and earlier\"}]}], \"references\": [{\"url\": \"https://www.buffalo.jp/news/detail/20240719-01.html\"}, {\"url\": \"https://jvn.jp/en/jp/JVN12824024/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected product from the product\u0027s specific management page, an arbitrary OS command may be executed.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"OS command injection\"}]}], \"providerMetadata\": {\"orgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"shortName\": \"jpcert\", \"dateUpdated\": \"2024-09-10T06:56:44.182Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-44072\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-10T19:58:39.140Z\", \"dateReserved\": \"2024-08-19T02:08:40.600Z\", \"assignerOrgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"datePublished\": \"2024-09-10T06:56:44.182Z\", \"assignerShortName\": \"jpcert\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

cve-2024-44072

Vulnerability from jvndb

Published

2024-08-23 14:17

Modified

2024-08-23 14:17

Severity ?

7.2 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

BUFFALO wireless LAN routers and wireless LAN repeaters vulnerable to OS command injection

Details

Wireless LAN routers and wireless LAN repeaters provided by BUFFALO INC. contain an OS command injection vulnerability (CWE-78). Yoshiki Mori and Masaki Kubo of National Institute of Information and Communications Technology, Cybersecurity Research Laboratory reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

▼	Type	URL
	JVN	https://jvn.jp/en/jp/JVN12824024/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-44072
	OS Command Injection(CWE-78)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

▼	Vendor	Product
	BUFFALO INC.	WHR-1166DHP
	BUFFALO INC.	WHR-300HP2
	BUFFALO INC.	WHR-600D
	BUFFALO INC.	WMR-300
	BUFFALO INC.	WSR-600DHP
	BUFFALO INC.	WEX-1166DHP
	BUFFALO INC.	WEX-1166DHP2
	BUFFALO INC.	WEX-1166DHPS
	BUFFALO INC.	WEX-300HPS/N
	BUFFALO INC.	WEX-300HPTX/N
	BUFFALO INC.	WEX-733DHP
	BUFFALO INC.	WEX-733DHP2
	BUFFALO INC.	WEX-733DHPS
	BUFFALO INC.	WEX-733DHPTX
	BUFFALO INC.	WHR-1166DHP2
	BUFFALO INC.	WHR-1166DHP3
	BUFFALO INC.	WHR-1166DHP4
	BUFFALO INC.	WSR-1166DHP3

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000087.html",
  "dc:date": "2024-08-23T14:17+09:00",
  "dcterms:issued": "2024-08-23T14:17+09:00",
  "dcterms:modified": "2024-08-23T14:17+09:00",
  "description": "Wireless LAN routers and wireless LAN repeaters provided by BUFFALO INC. contain an OS command injection vulnerability (CWE-78).\r\n\r\nYoshiki Mori and Masaki Kubo of National Institute of Information and Communications Technology, Cybersecurity Research Laboratory reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000087.html",
  "sec:cpe": [
    {
      "#text": "cpe:/h:buffalo_inc:whr-1166dhp",
      "@product": "WHR-1166DHP",
      "@vendor": "BUFFALO INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:buffalo_inc:whr-300hp2",
      "@product": "WHR-300HP2",
      "@vendor": "BUFFALO INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:buffalo_inc:whr-600d",
      "@product": "WHR-600D",
      "@vendor": "BUFFALO INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:buffalo_inc:wmr-300",
      "@product": "WMR-300",
      "@vendor": "BUFFALO INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:buffalo_inc:wsr-600dhp",
      "@product": "WSR-600DHP",
      "@vendor": "BUFFALO INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:buffalo_inc:wex-1166dhp",
      "@product": "WEX-1166DHP",
      "@vendor": "BUFFALO INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:buffalo_inc:wex-1166dhp2",
      "@product": "WEX-1166DHP2",
      "@vendor": "BUFFALO INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:buffalo_inc:wex-1166dhps",
      "@product": "WEX-1166DHPS",
      "@vendor": "BUFFALO INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:buffalo_inc:wex-300hps%2Fn",
      "@product": "WEX-300HPS/N",
      "@vendor": "BUFFALO INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:buffalo_inc:wex-300hptx%2Fn",
      "@product": "WEX-300HPTX/N",
      "@vendor": "BUFFALO INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:buffalo_inc:wex-733dhp",
      "@product": "WEX-733DHP",
      "@vendor": "BUFFALO INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:buffalo_inc:wex-733dhp2",
      "@product": "WEX-733DHP2",
      "@vendor": "BUFFALO INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:buffalo_inc:wex-733dhps",
      "@product": "WEX-733DHPS",
      "@vendor": "BUFFALO INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:buffalo_inc:wex-733dhptx",
      "@product": "WEX-733DHPTX",
      "@vendor": "BUFFALO INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:buffalo_inc:whr-1166dhp2",
      "@product": "WHR-1166DHP2",
      "@vendor": "BUFFALO INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:buffalo_inc:whr-1166dhp3",
      "@product": "WHR-1166DHP3",
      "@vendor": "BUFFALO INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:buffalo_inc:whr-1166dhp4",
      "@product": "WHR-1166DHP4",
      "@vendor": "BUFFALO INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:buffalo_inc:wsr-1166dhp3",
      "@product": "WSR-1166DHP3",
      "@vendor": "BUFFALO INC.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "7.2",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-000087",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN12824024/index.html",
      "@id": "JVN#12824024",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-44072",
      "@id": "CVE-2024-44072",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    }
  ],
  "title": "BUFFALO wireless LAN routers and wireless LAN repeaters vulnerable to OS command injection"
}

var-202408-2291

Vulnerability from variot

OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected product from the product's specific management page, an arbitrary OS command may be executed. Wireless provided by Buffalo Inc. Reporter: National Institute of Information and Communications Technology Cyber Security Research Lab Yoshiki Mori Mr

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202408-2291",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "wex-733dhps",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
        "version": null
      },
      {
        "model": "wex-1166dhp2",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
        "version": null
      },
      {
        "model": "whr-1166dhp2",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
        "version": null
      },
      {
        "model": "wex-1166dhp",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
        "version": null
      },
      {
        "model": "wex-300hptx/n",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
        "version": null
      },
      {
        "model": "whr-300hp2",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
        "version": null
      },
      {
        "model": "wmr-300",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
        "version": null
      },
      {
        "model": "wex-300hps/n",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
        "version": null
      },
      {
        "model": "whr-1166dhp3",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
        "version": null
      },
      {
        "model": "whr-600d",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
        "version": null
      },
      {
        "model": "wex-1166dhps",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
        "version": null
      },
      {
        "model": "wex-733dhp2",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
        "version": null
      },
      {
        "model": "wex-733dhptx",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
        "version": null
      },
      {
        "model": "wex-733dhp",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
        "version": null
      },
      {
        "model": "whr-1166dhp4",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
        "version": null
      },
      {
        "model": "whr-1166dhp",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
        "version": null
      },
      {
        "model": "wsr-600dhp",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
        "version": "ver. 2.93 and earlier  s"
      },
      {
        "model": "wsr-1166dhp3",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30d0\u30c3\u30d5\u30a1\u30ed\u30fc",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-000087"
      }
    ]
  },
  "cve": "CVE-2024-44072",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT",
            "author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "availabilityImpact": "LOW",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 0.9,
            "id": "CVE-2024-44072",
            "impactScore": 4.7,
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "IPA",
            "availabilityImpact": "High",
            "baseScore": 7.2,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "JVNDB-2024-000087",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "High",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "id": "CVE-2024-44072",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "IPA",
            "id": "JVNDB-2024-000087",
            "trust": 0.8,
            "value": "High"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-000087"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-44072"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected product from the product\u0027s specific management page, an arbitrary OS command may be executed. Wireless provided by Buffalo Inc. Reporter: National Institute of Information and Communications Technology Cyber Security Research Lab Yoshiki Mori Mr",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2024-44072"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-000087"
      }
    ],
    "trust": 1.62
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "JVN",
        "id": "JVN12824024",
        "trust": 1.8
      },
      {
        "db": "NVD",
        "id": "CVE-2024-44072",
        "trust": 1.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-000087",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-000087"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-44072"
      }
    ]
  },
  "id": "VAR-202408-2291",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.7
  },
  "last_update_date": "2024-09-11T22:47:01.361000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "NICTER Important notice regarding posting ( 7/19 update)",
        "trust": 0.8,
        "url": "https://www.buffalo.jp/news/detail/20240719-01.html"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-000087"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-78",
        "trust": 1.0
      },
      {
        "problemtype": "OS Command injection (CWE-78) [IPA evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-000087"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-44072"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.0,
        "url": "https://jvn.jp/en/jp/jvn12824024/"
      },
      {
        "trust": 1.0,
        "url": "https://www.buffalo.jp/news/detail/20240719-01.html"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/jp/jvn12824024/index.html"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-000087"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-44072"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-000087"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-44072"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2024-08-23T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2024-000087"
      },
      {
        "date": "2024-09-10T07:15:01.963000",
        "db": "NVD",
        "id": "CVE-2024-44072"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2024-08-23T03:20:00",
        "db": "JVNDB",
        "id": "JVNDB-2024-000087"
      },
      {
        "date": "2024-09-10T20:35:09.990000",
        "db": "NVD",
        "id": "CVE-2024-44072"
      }
    ]
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Buffalo radio LAN router and wireless LAN In repeaters OS Command injection vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-000087"
      }
    ],
    "trust": 0.8
  }
}

ghsa-4gj3-5752-q8g8

Vulnerability from github

Published

2024-09-10 09:31

Modified

2024-09-10 21:31

Severity ?

5.7 (Medium) - CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-44072"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-10T07:15:01Z",
    "severity": "MODERATE"
  },
  "details": "OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected product from the product\u0027s specific management page, an arbitrary OS command may be executed.",
  "id": "GHSA-4gj3-5752-q8g8",
  "modified": "2024-09-10T21:31:39Z",
  "published": "2024-09-10T09:31:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44072"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN12824024"
    },
    {
      "type": "WEB",
      "url": "https://www.buffalo.jp/news/detail/20240719-01.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

fkie_cve-2024-44072

Vulnerability from fkie_nvd

Published

2024-09-10 07:15

Modified

2024-09-10 20:35

Severity ?

5.7 (Medium) - CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

Summary

References

▼	URL	Tags
	vultures@jpcert.or.jp	https://jvn.jp/en/jp/JVN12824024/
	vultures@jpcert.or.jp	https://www.buffalo.jp/news/detail/20240719-01.html

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected product from the product\u0027s specific management page, an arbitrary OS command may be executed."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en los enrutadores y repetidores de LAN inal\u00e1mbrica de BUFFALO. Si un usuario inicia sesi\u00f3n en la p\u00e1gina de administraci\u00f3n y env\u00eda una solicitud especialmente manipulada al producto afectado desde la p\u00e1gina de administraci\u00f3n espec\u00edfica del producto, se puede ejecutar un comando arbitrario del sistema operativo."
    }
  ],
  "id": "CVE-2024-44072",
  "lastModified": "2024-09-10T20:35:09.990",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 4.7,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-09-10T07:15:01.963",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://jvn.jp/en/jp/JVN12824024/"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://www.buffalo.jp/news/detail/20240719-01.html"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

cve-2024-44072

Vulnerability from cvelistv5

cve-2024-44072

Vulnerability from jvndb

var-202408-2291

Vulnerability from variot

ghsa-4gj3-5752-q8g8

Vulnerability from github

fkie_cve-2024-44072

Vulnerability from fkie_nvd

Tags

Sightings

Nomenclature