Riskcovery

CVE-2024-44072

State
Published
Severity
5.7 Medium
Published
Sep 10, 2024
Updated
Sep 10, 2024
Reserved
Aug 19, 2024

Read the record on cve.org

Description

OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected product from the product's specific management page, an arbitrary OS command may be executed.

Scores

CVSSScoreVectorSource
3.15.7 MediumCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:LCISA-ADP

Weaknesses

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

ProductVersions
WHR-1166DHP2BUFFALO INC.
  • Ver. 2.95 and earlierAffected
WHR-1166DHP3BUFFALO INC.
  • Ver. 2.95 and earlierAffected
WHR-1166DHP4BUFFALO INC.
  • Ver. 2.95 and earlierAffected
WSR-1166DHP3BUFFALO INC.
  • Ver. 1.18 and earlierAffected
WSR-600DHPBUFFALO INC.
  • Ver. 2.93 and earlierAffected
WEX-300HPTX/NBUFFALO INC.
  • Ver. 1.02 and earlierAffected
WEX-733DHP2BUFFALO INC.
  • Ver. 1.03 and earlierAffected
WEX-1166DHP2BUFFALO INC.
  • Ver. 1.05 and earlierAffected
WEX-1166DHPSBUFFALO INC.
  • Ver. 1.05 and earlierAffected
WEX-300HPS/NBUFFALO INC.
  • Ver. 1.02 and earlierAffected
WEX-733DHPSBUFFALO INC.
  • Ver. 1.02 and earlierAffected
WEX-733DHPTXBUFFALO INC.
  • Ver. 1.03 and earlierAffected
WEX-1166DHPBUFFALO INC.
  • Ver. 1.23 and earlierAffected
WEX-733DHPBUFFALO INC.
  • Ver. 1.64 and earlierAffected
WHR-1166DHPBUFFALO INC.
  • Ver. 2.92 and earlierAffected
WHR-300HP2BUFFALO INC.
  • Ver. 2.51 and earlierAffected
WHR-600DBUFFALO INC.
  • Ver. 2.91 and earlierAffected
WMR-300BUFFALO INC.
  • Ver. 2.50 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.