CVE-2022-43443: BUFFALO INC. WXR-11000XE12, инжекция

Описание

Оригинално описание

OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted request is sent to the management page.

Засегнати продукти

• BUFFALO INC. WXR-11000XE12: firmware Ver. 1.10 and earlier
• BUFFALO INC. WXR-5700AX7S: firmware Ver. 1.27 and earlier
• BUFFALO INC. WXR-5700AX7B: firmware Ver. 1.27 and earlier
• BUFFALO INC. WSR-3200AX4S: firmware Ver. 1.26 and earlier
• BUFFALO INC. WSR-3200AX4B: firmware Ver. 1.25
• BUFFALO INC. WSR-2533DHP: firmware Ver. 1.08 and earlier
• BUFFALO INC. WSR-2533DHP2: firmware Ver. 1.22 and earlier
• BUFFALO INC. WSR-A2533DHP2: firmware Ver. 1.22 and earlier
• BUFFALO INC. WSR-2533DHP3: firmware Ver. 1.26 and earlier
• BUFFALO INC. WSR-A2533DHP3: firmware Ver. 1.26 and earlier
• BUFFALO INC. WSR-2533DHPL: firmware Ver. 1.08 and earlier
• BUFFALO INC. WSR-2533DHPL2: firmware Ver. 1.03 and earlier
• BUFFALO INC. WSR-2533DHPLS: firmware Ver. 1.07 and earlier
• BUFFALO INC. WSR-2533DHPLB: firmware Ver. 1.05
• BUFFALO INC. WSR-1166DHP: firmware Ver. 1.16 and earlier
• BUFFALO INC. WSR-1166DHP2: firmware Ver. 1.17 and earlier
• BUFFALO INC. WCR-1166DS: firmware Ver. 1.34 and earlier

Вид слабост

• CWE-78 Инжектиране на команди към операционната система

История

Други уязвимости в BUFFALO INC. WXR-11000XE12

• 4.2CVE-2024-26023
• 9.8CVE-2024-23486
• 6.8CVE-2022-43466
• 6.8CVE-2022-43486
• CVE-2017-10811

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2022-43443
• https://nvd.nist.gov/vuln/detail/CVE-2022-43443
• https://www.buffalo.jp/news/detail/20240131-01.html
• https://jvn.jp/en/vu/JVNVU97099584/