CVE-2011-1324
Multiple cross-site request forgery (CSRF) vulnerabilities in the management screen on Buffalo WHR, WZR2, WZR, WER, and BBR series routers with firmware 1.x; BHR-4RV and FS-G54 routers with firmware 2.x; and AS-100 routers allow remote attackers to hijack the authentication of administrators for requests that modify settings, as demonstrated by changing the login password.
- Score
- CVSS 2.0 5.8 Medium
- Status
- Modified - vultures@jpcert.or.jp
- Published
- 2011-05-09
- Last modified
- 2024-09-17
- Weaknesses
- CWE-352
Affected products
- As-100 (Buffalotech)
- Bbr-4hg (Buffalotech)
- Bbr-4hg Firmware (Buffalotech)
- Bbr-4mg (Buffalotech)
- Bbr-4mg Firmware (Buffalotech)
- Bhr-4rv (Buffalotech)
- Bhr-4rv Firmware (Buffalotech)
- Fs-g54 (Buffalotech)
- Fs-g54 Firmware (Buffalotech)
- Wer-a54g54 (Buffalotech)
- Wer-a54g54 Firmware (Buffalotech)
- Wer-ag54 (Buffalotech)
- Wer-ag54 Firmware (Buffalotech)
- Wer-am54g54 (Buffalotech)
- Wer-am54g54 Firmware (Buffalotech)
- Wer-amg54 (Buffalotech)
- Wer-amg54 Firmware (Buffalotech)
- Whr-am54g54 (Buffalotech)
- Whr-am54g54 Firmware (Buffalotech)
- Whr-amg54 (Buffalotech)
- Whr-amg54 Firmware (Buffalotech)
- Whr-ampg (Buffalotech)
- Whr-ampg Firmware (Buffalotech)
- Whr-g (Buffalotech)
- Whr-g54s (Buffalotech)
- Whr-g54s Firmware (Buffalotech)
- Whr-g Firmware (Buffalotech)
- Whr-hp-ampg (Buffalotech)
- Whr-hp-ampg Firmware (Buffalotech)
- Whr-hp-g (Buffalotech)
- Whr-hp-g54 (Buffalotech)
- Whr-hp-g54 Firmware (Buffalotech)
- Whr-hp-g Firmware (Buffalotech)
- Wzr-ampg144nh (Buffalotech)
- Wzr-ampg144nh Firmware (Buffalotech)
- Wzr-ampg300nh (Buffalotech)
- Wzr-ampg300nh Firmware (Buffalotech)
- Wzr-g144n (Buffalotech)
- Wzr-g144n Firmware (Buffalotech)
- Wzr-g144nh (Buffalotech)
- Wzr-g144nh Firmware (Buffalotech)
- Wzr2-g300n (Buffalotech)
- Wzr2-g300n Firmware (Buffalotech)
References
- http://buffalo.jp/support_s/20080808/csrf.html
- http://jvn.jp/en/jp/JVN50505257/index.html
