Skip to main content

Wsr 2533Dhp Firmware CVE-2024-26023

MEDIUM
OS Command Injection (CWE-78)
2024-04-15 vultures@jpcert.or.jp
Command Injection Wsr 2533Dhp Firmware Wsr 2533Dhpl Firmware Wsr 2533Dhp2 Firmware Wsr A2533Dhp2 Firmware Wcr 1166Ds Firmware Wsr 1166Dhp Firmware Wsr 1166Dhp2 Firmware
4.2
CVSS 3.1 · Vendor: jpcert
Share

Severity by source

Vendor (jpcert) PRIMARY
4.2 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Primary rating from Vendor (jpcert) · only source for this CVE.

CVSS VectorVendor: jpcert

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

1
CVE Published
Apr 15, 2024 - 11:15 cve.org
MEDIUM 4.2

DescriptionCVE.org

OS command injection vulnerability in BUFFALO wireless LAN routers allows a logged-in user to execute arbitrary OS commands.

AnalysisAI

OS command injection vulnerability in BUFFALO wireless LAN routers allows a logged-in user to execute arbitrary OS commands. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as OS Command Injection (CWE-78), which allows attackers to execute arbitrary operating system commands on the host. OS command injection vulnerability in BUFFALO wireless LAN routers allows a logged-in user to execute arbitrary OS commands. Affected products include: Buffalo Wsr-2533Dhp Firmware, Buffalo Wsr-2533Dhpl Firmware, Buffalo Wsr-2533Dhp2 Firmware, Buffalo Wsr-A2533Dhp2 Firmware, Buffalo Wcr-1166Ds Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Avoid passing user input to shell commands. Use language-specific APIs instead of shell execution. Apply strict input validation with allowlists.

More in Wsr 2533Dhp Firmware

View all
CVE-2024-23486 CRITICAL
9.8 Apr 15

Plaintext storage of a password issue exists in BUFFALO wireless LAN routers, which may allow a network-adjacent unauthe
CVE-2022-43443 HIGH
8.8 Dec 19

OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrar
CVE-2022-43486 MEDIUM
6.8 Dec 19

Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative

Same weakness CWE-78 – OS Command Injection

View all
CVE-2014-6271 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2025-64328 HIGH POC
8.6
CVE-2014-7169 CRITICAL POC
9.8
CVE-2017-6884 HIGH POC
8.8
CVE-2017-6077 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2025-64328 HIGH POC
8.6

Share

CVE-2024-26023 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy