JVN#09166495: Multiple vulnerabilities in Buffalo AirStation WHR-G54S

Buffalo AirStation WHR-G54S contains multiple vulnerabilities listed below.

Directory Traversal - CVE-2020-5605

Cross-site Scripting - CVE-2020-5606

Impact

• An attacker who is logged in to the product may access sensitive information such as setting values - CVE-2020-5605
• When a user who is logged in to the product accesses a specially crafted page, an arbitrary script may be executed on the user’s web browser - CVE-2020-5606

Solution

Apply a workaround
Applying the following workarounds may mitigate the impacts of these vulnerabilities.

• Log off when the setting screen is not being used
  • This product is designed to log off automatically when the setting screen is not operated for 5 minutes
• Do not check other web pages while logged in to the setting screen
• Change the default password
  Do not use the product
  According to the developer, the product is no longer supported and it is recommended for the users to use alternative products.
  Please refer to the information provided by the developer for more details.

Products Affected

• WHR-G54S firmware 1.43 and earlier