CVE-2022-43443

HIGH

Buffalo WSR-3200AX4S Firmware < 1.26 - OS Command Injection via Management Page

Title source: llm
STIX 2.1

Description

OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted request is sent to the management page.

References (2)

Core 2

Scores

CVSS v3 8.8
EPSS 0.0079
EPSS Percentile 51.6%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (11)
buffalo/wcr-1166ds_firmware < 1.34
buffalo/wsr-2533dhp2_firmware < 1.22
buffalo/wsr-2533dhp3_firmware < 1.26
buffalo/wsr-2533dhp_firmware < 1.08
buffalo/wsr-2533dhpl2_firmware < 1.03
buffalo/wsr-2533dhpl_firmware < 1.08
buffalo/wsr-2533dhpls_firmware < 1.07
buffalo/wsr-3200ax4b_firmware 1.25
buffalo/wsr-3200ax4s_firmware < 1.26
buffalo/wsr-a2533dhp2_firmware < 1.22
... and 1 more
Published Dec 19, 2022
Tracked Since Feb 18, 2026