OS Command Injection in BUFFALO INC. products - CVE-2022-43443

Vulnerability identifier: #VU70083

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-43443

CWE-ID: CWE-78

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation. A remote attacker on the local network can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

WSR-3200AX4S
WSR-2533DHPLS
WSR-2533DHPL2
WSR-2533DHPL
WSR-A2533DHP3
WCR-1166DS
WSR-2533DHP3
WSR-A2533DHP2
WSR-2533DHP2
WSR-2533DHP
WSR-3200AX4B

Install updates from vendor's website.

WSR-3200AX4S - update to 1.30
WSR-2533DHPLS - update to 1.10
WSR-2533DHPL2 - update to 1.04
WSR-2533DHPL - update to 1.09
WSR-A2533DHP3 - update to 1.27
WCR-1166DS - update to 1.35
WSR-2533DHP3 - update to 1.27
WSR-A2533DHP2 - update to 1.23
WSR-2533DHP2 - update to 1.23
WSR-2533DHP - update to 1.09
WSR-3200AX4B - update to 1.30

• https://jvn.jp/en/vu/JVNVU97099584/index.html
• https://www.buffalo.jp/news/detail/20221205-01.html

• Multiple vulnerabilities in Buffalo network devices