CVE-2022-43466

MEDIUM

Buffalo WSR-3200AX4S Firmware < 1.26 - Authenticated OS Command Injection via CGI Program

Title source: llm

Description

OS command injection vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS command if a specially crafted request is sent to a specific CGI program.

References (2)

Core 2

Core References

Various Sources

https://www.buffalo.jp/news/detail/20240131-01.html

Third Party Advisory

https://jvn.jp/en/vu/JVNVU97099584/

Scores

CVSS v3 6.8

EPSS 0.0078

EPSS Percentile 51.2%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-78

Status published

Products (10)

buffalo/wex-1800ax4_firmware < 1.13

buffalo/wex-1800ax4ea_firmware < 1.13

buffalo/wsr-2533dhp2_firmware < 1.22

buffalo/wsr-2533dhp3_firmware < 1.26

buffalo/wsr-2533dhpl2_firmware < 1.03

buffalo/wsr-2533dhpls_firmware < 1.07

buffalo/wsr-3200ax4b_firmware 1.25

buffalo/wsr-3200ax4s_firmware < 1.26

buffalo/wsr-a2533dhp2_firmware < 1.22

buffalo/wsr-a2533dhp3_firmware < 1.26

Published Dec 19, 2022

Tracked Since Feb 18, 2026