Wcr 1166Ds Firmware
CVE-2022-43486
MEDIUM
Severity by source
AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected devices.
AnalysisAI
Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected devices. Affected products include: Buffalo Wsr-3200Ax4S Firmware, Buffalo Wsr-3200Ax4B Firmware, Buffalo Wsr-2533Dhp2 Firmware, Buffalo Wsr-A2533Dhp2 Firmware, Buffalo Wsr-2533Dhp3 Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.
More in Wcr 1166Ds Firmware
View allOS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrar
Buffalo WCR-1166DS devices with firmware 1.30 and earlier allow an attacker to execute arbitrary OS commands via unspeci
OS command injection vulnerability in BUFFALO wireless LAN routers allows a logged-in user to execute arbitrary OS comma
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today