6.8
CVE-2022-43486
- EPSS 0.36%
- Veröffentlicht 19.12.2022 03:15:10
- Zuletzt bearbeitet 17.04.2025 15:15:48
- Erkennungen
LoginHidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected devices.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Buffalo ≫ Wsr-3200ax4s Firmware Version <= 1.26
Buffalo ≫ Wsr-3200ax4b Firmware Version 1.25
Buffalo ≫ Wsr-2533dhp2 Firmware Version <= 1.22
Buffalo ≫ Wsr-a2533dhp2 Firmware Version <= 1.22
Buffalo ≫ Wsr-2533dhp3 Firmware Version <= 1.26
Buffalo ≫ Wsr-a2533dhp3 Firmware Version <= 1.26
Buffalo ≫ Wsr-2533dhpl2 Firmware Version <= 1.03
Buffalo ≫ Wsr-2533dhpls Firmware Version <= 1.07
Buffalo ≫ Wex-1800ax4 Firmware Version <= 1.13
Buffalo ≫ Wex-1800ax4ea Firmware Version <= 1.13
Buffalo ≫ Wsr-2533dhp Firmware Version <= 1.08
Buffalo ≫ Wsr-2533dhpl Firmware Version <= 1.08
Buffalo ≫ Wcr-1166ds Firmware Version <= 1.34
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.36% | 0.279 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 6.8 | 0.9 | 5.9 |
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
| CISA-ADP | 6.8 | 0.9 | 5.9 |
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
CWE-94 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
https://jvn.jp/en/vu/JVNVU97099584/
https://www.buffalo.jp/news/detail/20240131-01.html