PT-2016-4593 · Buffalo · Wex-300+7

Satoshi Ogawa · Publicado 2016-01-22 · Atualizado 2016-03-11 · CVE-2016-1135

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions BUFFALO BHR-4GRV2 versions 1.04 and earlier BUFFALO WEX-300 versions 1.90 and earlier BUFFALO WHR-1166DHP versions 1.90 and earlier BUFFALO WHR-300HP2 versions 1.90 and earlier BUFFALO WHR-600D versions 1.90 and earlier BUFFALO WMR-300 versions 1.90 and earlier BUFFALO WMR-433 versions 1.01 and earlier BUFFALO WSR-1166DHP versions 1.01 and earlier

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. This could potentially lead to unauthorized access or control of the affected devices.

Recommendations For BUFFALO BHR-4GRV2 versions 1.04 and earlier, update to a version later than 1.04. For BUFFALO WEX-300 versions 1.90 and earlier, update to a version later than 1.90. For BUFFALO WHR-1166DHP versions 1.90 and earlier, update to a version later than 1.90. For BUFFALO WHR-300HP2 versions 1.90 and earlier, update to a version later than 1.90. For BUFFALO WHR-600D versions 1.90 and earlier, update to a version later than 1.90. For BUFFALO WMR-300 versions 1.90 and earlier, update to a version later than 1.90. For BUFFALO WMR-433 versions 1.01 and earlier, update to a version later than 1.01. For BUFFALO WSR-1166DHP versions 1.01 and earlier, update to a version later than 1.01.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-1135

Produtos afetados

Bhr-4Grv2

Wex-300

Whr-1166Dhp

Whr-300Hp2

Whr-600D

Wmr-300

Wmr-433

Wsr-1166Dhp

Referências · 4

• http://jvndb.jvn.jp/jvndb/JVNDB-2016-000006 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-1135 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-1135 · Aviso do Fabricante
• http://jvn.jp/en/jp/JVN49225722/index.html · Aviso do Fabricante