Vulnerability · Published Sep 10, 2024 · Assigned by jpcert
CVE-2024-44072
Medium 5.7
In plain English
A medium-severity OS command injection in WEX-1166DHP from BUFFALO INC.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 3.1)5.7Medium
Exploit odds (30 days)0.6%top 51.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected product from the product's specific management page, an arbitrary OS command may be executed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| BUFFALO INC. | WHR-1166DHP2 | Ver. 2.95 and earlier |
| BUFFALO INC. | WHR-1166DHP3 | Ver. 2.95 and earlier |
| BUFFALO INC. | WHR-1166DHP4 | Ver. 2.95 and earlier |
| BUFFALO INC. | WSR-1166DHP3 | Ver. 1.18 and earlier |
| BUFFALO INC. | WSR-600DHP | Ver. 2.93 and earlier |
| BUFFALO INC. | WEX-300HPTX/N | Ver. 1.02 and earlier |
| BUFFALO INC. | WEX-733DHP2 | Ver. 1.03 and earlier |
| BUFFALO INC. | WEX-1166DHP2 | Ver. 1.05 and earlier |
| BUFFALO INC. | WEX-1166DHPS | Ver. 1.05 and earlier |
| BUFFALO INC. | WEX-300HPS/N | Ver. 1.02 and earlier |
| BUFFALO INC. | WEX-733DHPS | Ver. 1.02 and earlier |
| BUFFALO INC. | WEX-733DHPTX | Ver. 1.03 and earlier |
| BUFFALO INC. | WEX-1166DHP | Ver. 1.23 and earlier |
| BUFFALO INC. | WEX-733DHP | Ver. 1.64 and earlier |
| BUFFALO INC. | WHR-1166DHP | Ver. 2.92 and earlier |
| BUFFALO INC. | WHR-300HP2 | Ver. 2.51 and earlier |
| BUFFALO INC. | WHR-600D | Ver. 2.91 and earlier |
| BUFFALO INC. | WMR-300 | Ver. 2.50 and earlier |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L