What is the CVSS score of CVE-2014-9284?

CVE-2014-9284 has a CVSS 2.0 base score of 7.7 (High). CVSS vector: AV:A/AC:L/Au:S/C:C/I:C/A:C. EPSS exploitation probability: 0.7%.

Wsr 600Dhp Firmware CVE-2014-9284

HIGH

OS Command Injection (CWE-78)

2015-06-09 vultures@jpcert.or.jp

Command Injection Wsr 600Dhp Firmware Whr 300Hp2 Firmware Whr 1166Dhp Firmware Bhr 4Grv2 Firmware Wmr 300 Firmware Wex 300 Firmware Whr 600D Firmware

7.7

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:A/AC:L/Au:S/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:A/AC:L/Au:S/C:C/I:C/A:C

Attack Vector

Adjacent

Attack Complexity

Low

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Jun 09, 2015 - 00:59 cve.org

HIGH 7.7

DescriptionCVE.org

The Buffalo WHR-1166DHP 1.60 and earlier, WSR-600DHP 1.60 and earlier, WHR-600D 1.60 and earlier, WHR-300HP2 1.60 and earlier, WMR-300 1.60 and earlier, WEX-300 1.60 and earlier, and BHR-4GRV2 1.04 and earlier routers allow remote authenticated users to execute arbitrary OS commands via unspecified vectors.

AnalysisAI

The Buffalo WHR-1166DHP 1.60 and earlier, WSR-600DHP 1.60 and earlier, WHR-600D 1.60 and earlier, WHR-300HP2 1.60 and earlier, WMR-300 1.60 and earlier, WEX-300 1.60 and earlier, and BHR-4GRV2 1.04. Rated high severity (CVSS 7.7), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as OS Command Injection (CWE-78), which allows attackers to execute arbitrary operating system commands on the host. The Buffalo WHR-1166DHP 1.60 and earlier, WSR-600DHP 1.60 and earlier, WHR-600D 1.60 and earlier, WHR-300HP2 1.60 and earlier, WMR-300 1.60 and earlier, WEX-300 1.60 and earlier, and BHR-4GRV2 1.04 and earlier routers allow remote authenticated users to execute arbitrary OS commands via unspecified vectors. Affected products include: Buffalotech Wsr-600Dhp Firmware, Buffalotech Whr-300Hp2 Firmware, Buffalotech Whr-1166Dhp Firmware, Buffalotech Bhr-4Grv2 Firmware, Buffalotech Wmr-300 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Avoid passing user input to shell commands. Use language-specific APIs instead of shell execution. Apply strict input validation with allowlists.