CVE-2024-23486

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-15 · updated 2026-06-17
Weakness: CWE-256

Description

Plaintext storage of a password issue exists in BUFFALO wireless LAN routers, which may allow a network-adjacent unauthenticated attacker with access to the product's login page may obtain configured credentials.

Affected products

Buffalo Wsr-2533Dhp2 Firmware: before 1.11 — fixed in 1.11
Buffalo Wsr-2533Dhp Firmware: before 1.07 — fixed in 1.07
Buffalo Wsr-2533Dhpl Firmware: before 1.07 — fixed in 1.07
Buffalo Wsr-A2533Dhp2 Firmware: before 1.11 — fixed in 1.11

How to fix

Upgrade to a fixed version: Buffalo Wsr-2533Dhp2 Firmware 1.11; Buffalo Wsr-2533Dhp Firmware 1.07; Buffalo Wsr-2533Dhpl Firmware 1.07; Buffalo Wsr-A2533Dhp2 Firmware 1.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-23486 or the next vulnerability affects your stack