What’s Vulnerable › Vulnerabilities

CVE-2022-43466

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-12-19 · updated 2026-06-17
• Weakness: CWE-78

Description

OS command injection vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS command if a specially crafted request is sent to a specific CGI program.

Affected products

• Buffalo Wex-1800Ax4 Firmware: through 1.13
• Buffalo Wex-1800Ax4Ea Firmware: through 1.13
• Buffalo Wsr-2533Dhp2 Firmware: through 1.22
• Buffalo Wsr-2533Dhp3 Firmware: through 1.26
• Buffalo Wsr-2533Dhpl2 Firmware: through 1.03
• Buffalo Wsr-2533Dhpls Firmware: through 1.07
• Buffalo Wsr-3200Ax4B Firmware: 1.25
• Buffalo Wsr-3200Ax4S Firmware: through 1.26
• Buffalo Wsr-A2533Dhp2 Firmware: through 1.22
• Buffalo Wsr-A2533Dhp3 Firmware: through 1.26

References

• https://jvn.jp/en/vu/JVNVU97099584/
• https://www.buffalo.jp/news/detail/20240131-01.html
• https://jvn.jp/en/vu/JVNVU97099584/
• https://www.buffalo.jp/news/detail/20240131-01.html

Get alerted when CVE-2022-43466 or the next vulnerability affects your stack