CVE-2022-43443

OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted request is sent to the management page.

Score

CVSS 3.1 8.8 High

Status

Modified - vultures@jpcert.or.jp

Published

2022-12-19

Last modified

2025-04-17

Weaknesses

CWE-78

Affected products

• Wcr-1166ds Firmware (Buffalo)
• Wsr-2533dhp2 Firmware (Buffalo)
• Wsr-2533dhp3 Firmware (Buffalo)
• Wsr-2533dhp Firmware (Buffalo)
• Wsr-2533dhpl2 Firmware (Buffalo)
• Wsr-2533dhpl Firmware (Buffalo)
• Wsr-2533dhpls Firmware (Buffalo)
• Wsr-3200ax4b Firmware (Buffalo)
• Wsr-3200ax4s Firmware (Buffalo)
• Wsr-a2533dhp2 Firmware (Buffalo)
• Wsr-a2533dhp3 Firmware (Buffalo)
• Wcr-1166ds (Buffalo Inc.)
• Wsr-1166dhp (Buffalo Inc.)
• Wsr-1166dhp2 (Buffalo Inc.)
• Wsr-2533dhp (Buffalo Inc.)
• Wsr-2533dhp2 (Buffalo Inc.)
• Wsr-2533dhp3 (Buffalo Inc.)
• Wsr-2533dhpl (Buffalo Inc.)
• Wsr-2533dhpl2 (Buffalo Inc.)
• Wsr-2533dhplb (Buffalo Inc.)
• Wsr-2533dhpls (Buffalo Inc.)
• Wsr-3200ax4b (Buffalo Inc.)
• Wsr-3200ax4s (Buffalo Inc.)
• Wsr-a2533dhp2 (Buffalo Inc.)
• Wsr-a2533dhp3 (Buffalo Inc.)
• Wxr-11000xe12 (Buffalo Inc.)
• Wxr-5700ax7b (Buffalo Inc.)
• Wxr-5700ax7s (Buffalo Inc.)

References

• https://jvn.jp/en/vu/JVNVU97099584/
• https://www.buffalo.jp/news/detail/20240131-01.html