PT-2024-13670 · Buffalo · Buffalo Ls210D

Christopher J. Pace + 1 · Published 2024-01-29 · Updated 2025-06-02 · CVE-2023-49038

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Buffalo LS210D version 1.78-0.03

Description The issue allows a remote authenticated attacker to inject arbitrary commands onto the NAS as root due to command injection in the ping utility.

Recommendations For Buffalo LS210D version 1.78-0.03, consider restricting access to the ping utility until a patch is available. As a temporary workaround, limit the use of the ping utility to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-49038

Affected Products

Buffalo Ls210D

References · 6

• 🔥 https://github.com/christopher-pace/CVE-2023-49038 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-49038 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49038 · Vendor Advisory
• https://t.me/cvenotify/124398 · Telegram Post
• https://t.me/cvenotify/69153 · Telegram Post
• https://t.me/cvenotify/70235 · Telegram Post