PT-2011-3055 · Buffalo · Buffalo Wzr2+7

Hirotaka Katagiri · Published 2011-05-09 · Updated 2011-05-27 · CVE-2011-1324

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Buffalo WHR, WZR2, WZR, WER, and BBR series routers versions 1.x Buffalo BHR-4RV and FS-G54 routers versions 2.x Buffalo AS-100 routers (affected versions not specified)

Description The issue allows remote attackers to hijack the authentication of administrators for requests that modify settings, such as changing the login password, due to multiple cross-site request forgery (CSRF) vulnerabilities in the management screen.

Recommendations For Buffalo WHR, WZR2, WZR, WER, and BBR series routers with firmware 1.x: update the firmware to a version that addresses the CSRF vulnerabilities. For Buffalo BHR-4RV and FS-G54 routers with firmware 2.x: update the firmware to a version that addresses the CSRF vulnerabilities. For Buffalo AS-100 routers: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2011-1324

Affected Products

Buffalo As-100

Buffalo Bbr

Buffalo Bhr-4Rv

Buffalo Fs-G54

Buffalo Wer

Buffalo Whr

Buffalo Wzr

Buffalo Wzr2

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2011-1324 · Security Note
• http://jvn.jp/en/jp/JVN50505257/index.html · Note
• http://buffalo.jp/support_s/20080808/csrf.html · Note