PT-2007-5960 · Buffalo · Buffalo Airstation Whr-G54S

Published 2007-09-11 · Updated 2018-10-15 · CVE-2007-4822

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Buffalo AirStation WHR-G54S version 1.20

Description: A cross-site request forgery (CSRF) issue exists in the device management interface, allowing remote attackers to make configuration changes as an administrator. This can be achieved via HTTP requests to certain HTML pages, specifically by accessing pages such as "ap.html" and "filter ip.html" with an "inp req" parameter to "cgi-bin/cgi".

Recommendations: For Buffalo AirStation WHR-G54S version 1.20, consider disabling access to the device management interface until a patch is available. Restrict access to the "cgi-bin/cgi" endpoint to minimize the risk of exploitation. Avoid using the "res" parameter in HTTP requests to certain HTML pages until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2007-4822

Affected Products

Buffalo Airstation Whr-G54S

References · 10

• 🔥 http://louhi.fi/advisory/buffalo_070907.txt · Exploit
• 🔥 http://securityfocus.com/bid/25588 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4822 · Security Note
• http://securityfocus.com/archive/1/478795/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4822 · Note
• http://secunia.com/advisories/26712 · Note
• http://osvdb.org/37665 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36492 · Note
• http://securityfocus.com/archive/1/478801/100/0/threaded · Note
• http://securityreason.com/securityalert/3117 · Note