Lucene search

JpcertCVE-2022-34840

HistoryDec 07, 2022 - 10:15 a.m.

CVE-2022-34840

2022-12-0710:15:10

CWE-798

jpcert

web.nvd.nist.gov

cve-2022-34840

hard-coded credentials

vulnerability

buffalo network devices

nvd

security

configuration settings

network security

CVSS3

6.5

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

23.1%

JSON

Use of hard-coded credentials vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to alter?configuration settings of the device. The affected products/versions are as follows: WZR-300HP firmware Ver. 2.00 and earlier, WZR-450HP firmware Ver. 2.00 and earlier, WZR-600DHP firmware Ver. 2.00 and earlier, WZR-900DHP firmware Ver. 1.15 and earlier, HW-450HP-ZWE firmware Ver. 2.00 and earlier, WZR-450HP-CWT firmware Ver. 2.00 and earlier, WZR-450HP-UB firmware Ver. 2.00 and earlier, WZR-600DHP2 firmware Ver. 1.15 and earlier, and WZR-D1100H firmware Ver. 2.00 and earlier.

Affected configurations

Nvd

Vulners

Node

buffalowzr-300hp_firmwareRange≤2.00

AND

buffalowzr-300hpMatch-

Node

buffalowzr-450hp_firmwareRange≤2.00

AND

buffalowzr-450hpMatch-

Node

buffalowzr-600dhp_firmwareRange≤2.00

AND

buffalowzr-600dhpMatch-

Node

buffalowzr-900dhp_firmwareRange≤1.15

AND

buffalowzr-900dhpMatch-

Node

buffalohw-450hp-zwe_firmwareRange≤2.00

AND

buffalohw-450hp-zweMatch-

Node

buffalowzr-450hp-cwt_firmwareRange≤2.00

AND

buffalowzr-450hp-cwtMatch-

Node

buffalowzr-450hp-ub_firmwareRange≤2.00

AND

buffalowzr-450hp-ubMatch-

Node

buffalowzr-600dhp2_firmwareRange≤1.15

AND

buffalowzr-600dhp2Match-

Node

buffalowzr-d1100h_firmwareRange≤2.00

AND

buffalowzr-d1100hMatch-

VendorProductVersionCPE
buffalowzr-300hp_firmware*cpe:2.3:o:buffalo:wzr-300hp_firmware:*:*:*:*:*:*:*:*
buffalowzr-300hp-cpe:2.3:h:buffalo:wzr-300hp:-:*:*:*:*:*:*:*
buffalowzr-450hp_firmware*cpe:2.3:o:buffalo:wzr-450hp_firmware:*:*:*:*:*:*:*:*
buffalowzr-450hp-cpe:2.3:h:buffalo:wzr-450hp:-:*:*:*:*:*:*:*
buffalowzr-600dhp_firmware*cpe:2.3:o:buffalo:wzr-600dhp_firmware:*:*:*:*:*:*:*:*
buffalowzr-600dhp-cpe:2.3:h:buffalo:wzr-600dhp:-:*:*:*:*:*:*:*
buffalowzr-900dhp_firmware*cpe:2.3:o:buffalo:wzr-900dhp_firmware:*:*:*:*:*:*:*:*
buffalowzr-900dhp-cpe:2.3:h:buffalo:wzr-900dhp:-:*:*:*:*:*:*:*
buffalohw-450hp-zwe_firmware*cpe:2.3:o:buffalo:hw-450hp-zwe_firmware:*:*:*:*:*:*:*:*
buffalohw-450hp-zwe-cpe:2.3:h:buffalo:hw-450hp-zwe:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
buffalo	wzr-300hp_firmware	*	cpe:2.3:o:buffalo:wzr-300hp_firmware::::::::
buffalo	wzr-300hp	-	cpe:2.3:h:buffalo:wzr-300hp:-:::::::*
buffalo	wzr-450hp_firmware	*	cpe:2.3:o:buffalo:wzr-450hp_firmware::::::::
buffalo	wzr-450hp	-	cpe:2.3:h:buffalo:wzr-450hp:-:::::::*
buffalo	wzr-600dhp_firmware	*	cpe:2.3:o:buffalo:wzr-600dhp_firmware::::::::
buffalo	wzr-600dhp	-	cpe:2.3:h:buffalo:wzr-600dhp:-:::::::*
buffalo	wzr-900dhp_firmware	*	cpe:2.3:o:buffalo:wzr-900dhp_firmware::::::::
buffalo	wzr-900dhp	-	cpe:2.3:h:buffalo:wzr-900dhp:-:::::::*
buffalo	hw-450hp-zwe_firmware	*	cpe:2.3:o:buffalo:hw-450hp-zwe_firmware::::::::
buffalo	hw-450hp-zwe	-	cpe:2.3:h:buffalo:hw-450hp-zwe:-:::::::*

Rows per page:

1-10 of 181

CNA Affected

[
  {
    "vendor": "BUFFALO INC.",
    "product": "Buffalo network devices",
    "versions": [
      {
        "version": "WZR-300HP firmware Ver. 2.00 and earlier, WZR-450HP firmware Ver. 2.00 and earlier, WZR-600DHP firmware Ver. 2.00 and earlier, WZR-900DHP firmware Ver. 1.15 and earlier, HW-450HP-ZWE firmware Ver. 2.00 and earlier, WZR-450HP-CWT firmware Ver. 2.00 and earlier, WZR-450HP-UB firmware Ver. 2.00 and earlier, WZR-600DHP2 firmware Ver. 1.15 and earlier, and WZR-D1100H firmware Ver. 2.00 and earlier.",
        "status": "affected"
      }
    ]
  }
]

References

jvn.jp/en/vu/JVNVU92805279/index.html

www.buffalo.jp/news/detail/20221003-01.html

CVSS3

6.5

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

23.1%

JSON

Related for CVE-2022-34840