CVE-2015-8262

Buffalo WZR-600DHP2 devices with firmware 2.09, 2.13, and 2.16 use an improper algorithm for selecting the ID value in the header of a DNS query, which makes it easier for remote attackers to spoof responses by predicting this value...

Input validation

Buffalo WZR-600DHP2 devices with firmware 2.09, 2.13, and 2.16 use an improper algorithm for selecting the ID value in the header of a DNS query, which makes it easier for remote attackers to spoof responses by predicting this value...

CVE-2015-8262

Buffalo WZR-600DHP2 devices with firmware 2.09, 2.13, and 2.16 use an improper algorithm for selecting the ID value in the header of a DNS query, which makes it easier for remote attackers to spoof responses by predicting this value...

CVE-2015-8262

CVE-2015-8262 affects Buffalo AirStation Extreme N600 Router WZR-600DHP2 (firmware 2.09, 2.13, 2.16). The issue is use of insufficiently random values in DNS queries: DNS TXIDs are predictable and source ports can be static, enabling a remote attacker to spoof responses and misdirect LAN clients....

PT-2015-7758

Name of the Vulnerable Software and Affected Versions Buffalo WZR-600DHP2 versions 2.09 through 2.16 Description The issue is related to an improper algorithm used for selecting the ID value in the header of a DNS query. This makes it easier for remote attackers to spoof responses by predicting...

CVE-2015-8262: Undefined Security Weakness

Buffalo WZR-600DHP2 devices with firmware 2.09, 2.13, and 2.16 use an improper algorithm for selecting the ID value in the header of a DNS query, which makes it easier for remote attackers to spoof responses by predicting this value...

Buffalo AirStation Extreme N600 WZR-600DHP2 Router Security Bypass Vulnerability

The Buffalo AirStation Extreme N600 WZR-600DHP2 is a router product from the Buffalo Group of Japan. A security bypass vulnerability exists in the Buffalo AirStation Extreme N600 WZR-600DHP2 Router. An attacker can exploit this vulnerability to bypass security restrictions and gain unauthorized...

Buffalo AirStation Extreme N600 Router WZR-600DHP2 uses insufficiently random values for DNS queries

Overview Buffalo AirStation Extreme N600 Router WZR-600DHP2, firmware versions 2.09, 2.13, 2.16, and possibly others, uses insufficiently random values for DNS queries and is vulnerable to DNS spoofing attacks. Description CWE-330: Use of Insufficiently Random Values - CVE-2015-8262The Buffalo...

[RT-SA-2015-006] Buffalo LinkStation Authentication Bypass

Advisory: Buffalo LinkStation Authentication Bypass An authentication bypass vulnerability in the web interface of a Buffalo LinkStation Duo Network Attached Storage NAS device allows unauthenticated attackers to gain administrative privileges. This puts the confidentiality and integrity of the...

Buffalo LinkStation authentication bypass

Session validity is not checked on request...

Buffalo LinkStation 1.34 / 1.69 / 1.70 Authentication Bypass

An authentication bypass vulnerability in the web interface of a Buffalo LinkStation Duo Network Attached Storage NAS device allows unauthenticated attackers to gain administrative privileges. This puts the confidentiality and integrity of the stored data as well as the integrity of the device...

Buffalo LinkStation 1.34 / 1.69 / 1.70 Authentication Bypass

Advisory: Buffalo LinkStation Authentication Bypass An authentication bypass vulnerability in the web interface of a Buffalo LinkStation Duo Network Attached Storage NAS device allows unauthenticated attackers to gain administrative privileges. This puts the confidentiality and integrity of the...

Design/Logic Flaw

The Buffalo WHR-1166DHP 1.60 and earlier, WSR-600DHP 1.60 and earlier, WHR-600D 1.60 and earlier, WHR-300HP2 1.60 and earlier, WMR-300 1.60 and earlier, WEX-300 1.60 and earlier, and BHR-4GRV2 1.04 and earlier routers allow remote authenticated users to execute arbitrary OS commands via unspecifi...

CVE-2014-9284

The Buffalo WHR-1166DHP 1.60 and earlier, WSR-600DHP 1.60 and earlier, WHR-600D 1.60 and earlier, WHR-300HP2 1.60 and earlier, WMR-300 1.60 and earlier, WEX-300 1.60 and earlier, and BHR-4GRV2 1.04 and earlier routers allow remote authenticated users to execute arbitrary OS commands via unspecifi...

CVE-2014-9284

The CVE-2014-9284 entry concerns Buffalo wireless routers, specifically WHR-1166DHP, WSR-600DHP, WHR-600D, WHR-300HP2, WMR-300, WEX-300, and BHR-4GRV2 with affected versions 1.60 (or 1.04 for BHR-4GRV2) and earlier. The issue is an OS command injection vulnerability that can be exploited by an au...

CVE-2014-9284: Improper Neutralization of Special Elements used in an OS Command

The Buffalo WHR-1166DHP 1.60 and earlier, WSR-600DHP 1.60 and earlier, WHR-600D 1.60 and earlier, WHR-300HP2 1.60 and earlier, WMR-300 1.60 and earlier, WEX-300 1.60 and earlier, and BHR-4GRV2 1.04 and earlier routers allow remote authenticated users to execute arbitrary OS commands via unspecifi...

Arbitrary Command Execution Vulnerability in Multiple Buffalo Routers

Buffalo WHR-1166DHP and others are wireless router products from the Buffalo Group in Japan. A security vulnerability exists in several Buffalo routers, which could be exploited by remote attackers to submit a special request and execute arbitrary OS commands...

CVE-2014-9284

The Buffalo WHR-1166DHP 1.60 and earlier, WSR-600DHP 1.60 and earlier, WHR-600D 1.60 and earlier, WHR-300HP2 1.60 and earlier, WMR-300 1.60 and earlier, WEX-300 1.60 and earlier, and BHR-4GRV2 1.04 and earlier routers allow remote authenticated users to execute arbitrary OS commands via unspecifi...

Multiple Buffalo wireless LAN routers vulnerable to OS command injection

Overview Multiple wireless LAN routers provided by BUFFALO INC. contain an OS command injection vulnerability. Masashi Sakai, Satoshi Ogawa reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An authenticated...

JVN#50447904: Multiple Buffalo wireless LAN routers vulnerable to OS command injection

Multiple wireless LAN routers provided by BUFFALO INC. contain an OS command injection vulnerability. Impact An authenticated attacker may be able to execute arbitrary OS commands. Solution Update the Firmware Apply the appropriate firmware update provided by the developer. Products Affected...