cbcvebase.
CVE-2022-43466
published 2022-12-19

CVE-2022-43466: OS command injection vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS…

PriorityP339medium6.8CVSS 3.1
AVAACLPRHUINSUCHIHAH
EPSS
0.78%
51.2th percentile
OS command injection vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS command if a specially crafted request is sent to a specific CGI program.

Affected

23 ranges
VendorProductVersion rangeFixed in
buffalowex-1800ax4_firmware<= 1.13—
buffalowex-1800ax4ea_firmware<= 1.13—
buffalowsr-2533dhp2_firmware<= 1.22—
buffalowsr-2533dhp3_firmware<= 1.26—
buffalowsr-2533dhpl2_firmware<= 1.03—
buffalowsr-2533dhpls_firmware<= 1.07—
buffalowsr-3200ax4b_firmware——
buffalowsr-3200ax4s_firmware<= 1.26—
buffalowsr-a2533dhp2_firmware<= 1.22—
buffalowsr-a2533dhp3_firmware<= 1.26—
buffalo_incwex-1800ax4——
buffalo_incwex-1800ax4ea——
buffalo_incwsr-2533dhp2——
buffalo_incwsr-2533dhp3——
buffalo_incwsr-2533dhpl2——
buffalo_incwsr-2533dhplb——
buffalo_incwsr-2533dhpls——
buffalo_incwsr-3200ax4b——
buffalo_incwsr-3200ax4s——
buffalo_incwsr-a2533dhp2——
buffalo_incwsr-a2533dhp3——
buffalo_incwxr-5700ax7b——
buffalo_incwxr-5700ax7s——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.