CVE-2016-1134

HIGH

BUFFALO WHR-1166DHP/300HP2/WMR-300/BHR-4GRV2/WEX-300/600D/WMR-433/WSR-1166DHP CSRF

Title source: llm

Description

Cross-site request forgery (CSRF) vulnerability on BUFFALO BHR-4GRV2 devices with firmware 1.04 and earlier, WEX-300 devices with firmware 1.90 and earlier, WHR-1166DHP devices with firmware 1.90 and earlier, WHR-300HP2 devices with firmware 1.90 and earlier, WHR-600D devices with firmware 1.90 and earlier, WMR-300 devices with firmware 1.90 and earlier, WMR-433 devices with firmware 1.01 and earlier, and WSR-1166DHP devices with firmware 1.01 and earlier allows remote attackers to hijack the authentication of arbitrary users.

References (2)

Core 2

Core References

Vendor Advisory third-party-advisory x_refsource_jvndb

http://jvndb.jvn.jp/jvndb/JVNDB-2016-000005

Vendor Advisory third-party-advisory x_refsource_jvn

http://jvn.jp/en/jp/JVN09268287/index.html

Scores

CVSS v3 8.8

EPSS 0.0054

EPSS Percentile 41.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-352

Status published

Products (8)

buffalotech/bhr-4grv2_firmware < 1.04

buffalotech/wex-300_firmware < 1.90

buffalotech/whr-1166dhp_firmware < 1.90

buffalotech/whr-300hp2_firmware < 1.90

buffalotech/whr-600d_firmware < 1.90

buffalotech/wmr-300_firmware < 1.90

buffalotech/wmr-433_firmware < 1.01

buffalotech/wsr-1166dhp_firmware < 1.01

Published Jan 22, 2016

Tracked Since Feb 18, 2026