PT-2016-4593 · Buffalo · Wex-300+7

Satoshi Ogawa · Published 2016-01-22 · Updated 2016-03-11 · CVE-2016-1135

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions BUFFALO BHR-4GRV2 versions 1.04 and earlier BUFFALO WEX-300 versions 1.90 and earlier BUFFALO WHR-1166DHP versions 1.90 and earlier BUFFALO WHR-300HP2 versions 1.90 and earlier BUFFALO WHR-600D versions 1.90 and earlier BUFFALO WMR-300 versions 1.90 and earlier BUFFALO WMR-433 versions 1.01 and earlier BUFFALO WSR-1166DHP versions 1.01 and earlier

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. This could potentially lead to unauthorized access or control of the affected devices.

Recommendations For BUFFALO BHR-4GRV2 versions 1.04 and earlier, update to a version later than 1.04. For BUFFALO WEX-300 versions 1.90 and earlier, update to a version later than 1.90. For BUFFALO WHR-1166DHP versions 1.90 and earlier, update to a version later than 1.90. For BUFFALO WHR-300HP2 versions 1.90 and earlier, update to a version later than 1.90. For BUFFALO WHR-600D versions 1.90 and earlier, update to a version later than 1.90. For BUFFALO WMR-300 versions 1.90 and earlier, update to a version later than 1.90. For BUFFALO WMR-433 versions 1.01 and earlier, update to a version later than 1.01. For BUFFALO WSR-1166DHP versions 1.01 and earlier, update to a version later than 1.01.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-1135

Affected Products

Bhr-4Grv2

Wex-300

Whr-1166Dhp

Whr-300Hp2

Whr-600D

Wmr-300

Wmr-433

Wsr-1166Dhp

References · 4

• http://jvndb.jvn.jp/jvndb/JVNDB-2016-000006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1135 · Security Note
• https://osv.dev/vulnerability/CVE-2016-1135 · Vendor Advisory
• http://jvn.jp/en/jp/JVN49225722/index.html · Vendor Advisory