CVE-2024-26023

Severity: medium (CVSS 4.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-15 · updated 2026-06-17
Weakness: CWE-78

Description

OS command injection vulnerability in BUFFALO wireless LAN routers allows a logged-in user to execute arbitrary OS commands.

Affected products

BUFFALO INC. WCR-1166DS: before 1.33 — fixed in 1.33
Buffalo Wsr-1166Dhp2 Firmware: before 1.15 — fixed in 1.15
Buffalo Wsr-1166Dhp Firmware: before 1.15 — fixed in 1.15
Buffalo Wsr-2533Dhp2 Firmware: before 1.11 — fixed in 1.11
Buffalo Wsr-2533Dhp Firmware: before 1.07 — fixed in 1.07
Buffalo Wsr-2533Dhpl Firmware: before 1.07 — fixed in 1.07
Buffalo Wsr-A2533Dhp2 Firmware: before 1.11 — fixed in 1.11

How to fix

Upgrade to a fixed version: BUFFALO INC. WCR-1166DS 1.33; Buffalo Wsr-1166Dhp2 Firmware 1.15; Buffalo Wsr-1166Dhp Firmware 1.15; Buffalo Wsr-2533Dhp2 Firmware 1.11; Buffalo Wsr-2533Dhp Firmware 1.07; Buffalo Wsr-2533Dhpl Firmware 1.07; Buffalo Wsr-A2533Dhp2 Firmware 1.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-26023 or the next vulnerability affects your stack