Buffalo WXR9300BE6P CVE-2025-61941

Exploitation requires an authenticated administrative session on the WXR9300BE6P series web management interface (CVSS PR:H) running firmware prior to Ver.1.10; an attacker must first log in as an administrator. Given that prerequisite, the path traversal allows arbitrary file alteration, and altering specific files escalates to arbitrary OS command execution. The primary limiting factor is the need for administrative credentials, which confines the attack to insiders or attackers who have already compromised admin access (e.g., via default/weak passwords, credential reuse, CSRF, or an internet-exposed management panel). No end-user interaction is required (UI:N), and the attack is deliverable over the network to the admin interface (AV:N).

This is a credible but not top-tier priority. The CVSS 4.0 base score of 8.6 (HIGH) is driven by network attack vector (AV:N), low complexity (AC:L), and full triad impact (VC:H/VI:H/VA:H), but it is meaningfully gated by PR:H - exploitation requires an already-authenticated administrative user on the router's management interface. The vector and the description agree on this point (the description explicitly says 'an administrative user who logs in to the affected product'), so there is no AV/PR conflict to resolve. EPSS is low at 0.53% (43rd percentile), which is consistent with an auth-required flaw that is unlikely to be mass-exploited. There is no CISA KEV listing and no public exploit identified, so there is no evidence of active exploitation. The practical risk is post-authentication privilege escalation: an admin-level web user converts their bounded management access into arbitrary file write and ultimately arbitrary OS command execution on the device, effectively achieving root-level control beyond the intended admin boundary. Real-world impact therefore depends heavily on how an attacker obtains admin credentials in the first place (default/weak passwords, credential reuse, CSRF, or exposed management interfaces). Treat as a firmware-update priority for affected Buffalo deployments rather than an emergency internet-wide threat.

An attacker who has obtained administrative access to the router's web management interface (via default/weak credentials, credential reuse, or an exposed admin panel) submits a request abusing the path traversal flaw to write to or alter a file outside the intended directory. By overwriting a sensitive configuration or script file, the attacker causes arbitrary OS commands to be executed on the device, gaining full control of the router. No public exploit code has been identified at time of analysis.