What is the CVSS score of CVE-2022-43443?

CVE-2022-43443 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Wsr 3200Ax4S Firmware CVE-2022-43443

HIGH

OS Command Injection (CWE-78)

2022-12-19 vultures@jpcert.or.jp

Command Injection Wsr 3200Ax4S Firmware Wsr 3200Ax4B Firmware Wsr 2533Dhp2 Firmware Wsr A2533Dhp2 Firmware Wsr 2533Dhp3 Firmware Wsr A2533Dhp3 Firmware Wsr 2533Dhpl2 Firmware Wsr 2533Dhpls Firmware Wsr 2533Dhp Firmware Wsr 2533Dhpl Firmware Wcr 1166Ds Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Dec 19, 2022 - 03:15 nvd

HIGH 8.8

DescriptionNVD

OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted request is sent to the management page.

AnalysisAI

OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted request is sent to the management page. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as OS Command Injection (CWE-78), which allows attackers to execute arbitrary operating system commands on the host. OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted request is sent to the management page. Affected products include: Buffalo Wsr-3200Ax4S Firmware, Buffalo Wsr-3200Ax4B Firmware, Buffalo Wsr-2533Dhp2 Firmware, Buffalo Wsr-A2533Dhp2 Firmware, Buffalo Wsr-2533Dhp3 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Avoid passing user input to shell commands. Use language-specific APIs instead of shell execution. Apply strict input validation with allowlists.