Multiple vulnerabilities in BUFFALO wireless LAN routers

Published: 2024-04-15

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2024-23486 CVE-2024-26023
CWE-ID	CWE-256 CWE-78
Exploitation vector	Local network
Public exploit	N/A
Vulnerable software	WSR-2533DHP Hardware solutions / Routers & switches, VoIP, GSM, etc WSR-2533DHPL Hardware solutions / Routers & switches, VoIP, GSM, etc WSR-2533DHP2 Hardware solutions / Routers & switches, VoIP, GSM, etc WSR-A2533DHP2 Hardware solutions / Routers & switches, VoIP, GSM, etc WCR-1166DS Hardware solutions / Routers & switches, VoIP, GSM, etc WSR-1166DHP Hardware solutions / Routers & switches, VoIP, GSM, etc WSR-1166DHP2 Hardware solutions / Routers & switches, VoIP, GSM, etc
Vendor	BUFFALO INC.

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Unprotected storage of credentials

EUVDB-ID: #VU88518

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-23486

CWE-ID: CWE-256 - Unprotected Storage of Credentials

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to other users' credentials.

The vulnerability exists due to application stored credentials in plain text in a configuration file on the system. A remote attacker on the local network can obtain configured credentials.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

WSR-2533DHP: 1.06

WSR-2533DHPL: 1.06

WSR-2533DHP2: 1.06

WSR-A2533DHP2: 1.10

CPE2.3

External links

https://jvn.jp/en/jp/JVN58236836/index.html
https://www.buffalo.jp/news/detail/20240410-01.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) OS Command Injection

EUVDB-ID: #VU88519

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26023

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation. A remote administrator on the local network can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.