Authentication bypass using an alternate path or channel in BUFFALO INC. products - CVE-2022-40966

Vulnerability identifier: #VU67888

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-40966

CWE-ID: CWE-288

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. A remote attacker on the local network can bypass authentication for the target device.

WZR-900DHP
WZR-HP-AG300H
WLAE-AG300N
WHR-HP-GN
WCR-300
WPL-05G300
WZR-HP-G302H
WZR-300HP
BHR-4GRV
WZR-600DHP
WZR-450HP
WHR-HP-G300N
WZR-1750DHP2
WXR-1900DHP
WXR-1900DHP2
WXR-1900DHP3
WTR-M2133HP
WEM-1266
WEM-1266WP
WRM-D2133HP
WTR-M2133HS
WRM-D2133HS
FS-G300N
FS-HP-G300N
WXR-6000AX12S
WXR-5950AX12
FS-R600DHP
FS-600DHP
WXR-6000AX12B

Install updates from vendor's website.

WZR-900DHP - update to 1.16
WZR-HP-AG300H - update to 1.77
WLAE-AG300N - update to 1.87
WHR-HP-GN - update to 1.88
WCR-300 - update to 1.88
WPL-05G300 - update to 1.89
WZR-HP-G302H - update to 1.89
WZR-300HP - update to 2.01
BHR-4GRV - update to 2.01
WZR-600DHP - update to 2.01
WZR-450HP - update to 2.01
WHR-HP-G300N - update to 2.01
WZR-1750DHP2 - update to 2.32
WXR-1900DHP - update to 2.51
WXR-1900DHP2 - update to 2.60
WXR-1900DHP3 - update to 2.64
WTR-M2133HP - update to 2.86
WEM-1266 - update to 2.86
WEM-1266WP - update to 2.86
WRM-D2133HP - update to 2.86
WTR-M2133HS - update to 2.97
WRM-D2133HS - update to 2.97
FS-G300N - update to 3.15
FS-HP-G300N - update to 3.34
WXR-6000AX12S - update to 3.41
WXR-5950AX12 - update to 3.41
FS-R600DHP - update to 3.41
FS-600DHP - update to 3.41
WXR-6000AX12B - update to 3.41

• https://jvn.jp/en/vu/JVNVU92805279/index.html
• https://www.buffalo.jp/news/detail/20221003-01.html

• Multiple vulnerabilities in Buffalo network devices