CVE-2022-34840

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-07 · updated 2026-06-17
Weakness: CWE-798

Description

Use of hard-coded credentials vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to alter?configuration settings of the device. The affected products/versions are as follows: WZR-300HP firmware Ver. 2.00 and earlier, WZR-450HP firmware Ver. 2.00 and earlier, WZR-600DHP firmware Ver. 2.00 and earlier, WZR-900DHP firmware Ver. 1.15 and earlier, HW-450HP-ZWE firmware Ver. 2.00 and earlier, WZR-450HP-CWT firmware Ver. 2.00 and earlier, WZR-450HP-UB firmware Ver. 2.00 and earlier, WZR-600DHP2 firmware Ver. 1.15 and earlier, and WZR-D1100H firmware Ver. 2.00 and earlier.

Affected products

Buffalo Hw-450Hp-Zwe Firmware: through 2.00
Buffalo Wzr-300Hp Firmware: through 2.00
Buffalo Wzr-450Hp-Cwt Firmware: through 2.00
Buffalo Wzr-450Hp-Ub Firmware: through 2.00
Buffalo Wzr-450Hp Firmware: through 2.00
Buffalo Wzr-600Dhp2 Firmware: through 1.15
Buffalo Wzr-600Dhp Firmware: through 2.00
Buffalo Wzr-900Dhp Firmware: through 1.15
Buffalo Wzr-D1100H Firmware: through 2.00

References

Get alerted when CVE-2022-34840 or the next vulnerability affects your stack