var-201506-0008
Vulnerability from variot
The Buffalo WHR-1166DHP 1.60 and earlier, WSR-600DHP 1.60 and earlier, WHR-600D 1.60 and earlier, WHR-300HP2 1.60 and earlier, WMR-300 1.60 and earlier, WEX-300 1.60 and earlier, and BHR-4GRV2 1.04 and earlier routers allow remote authenticated users to execute arbitrary OS commands via unspecified vectors. Multiple wireless LAN routers provided by BUFFALO INC. contain an OS command injection vulnerability. Masashi Sakai, Satoshi Ogawa reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.An authenticated attacker may be able to execute arbitrary OS commands. Buffalo WHR-1166DHP, etc
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201506-0008", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "wsr-600dhp", "scope": "lte", "trust": 1.0, "vendor": "buffalotech", "version": "1.60" }, { "model": "whr-1166dhp", "scope": "lte", "trust": 1.0, "vendor": "buffalotech", "version": "1.60" }, { "model": "whr-300hp2", "scope": "lte", "trust": 1.0, "vendor": "buffalotech", "version": "1.60" }, { "model": "wmr-300", "scope": "lte", "trust": 1.0, "vendor": "buffalotech", "version": "1.60" }, { "model": "wex-300", "scope": "lte", "trust": 1.0, "vendor": "buffalotech", "version": "1.60" }, { "model": "whr-600d", "scope": "lte", "trust": 1.0, "vendor": "buffalotech", "version": "1.60" }, { "model": "bhr-4grv2", "scope": "lte", "trust": 1.0, "vendor": "buffalotech", "version": "1.04" }, { "model": "bhr-4grv2", "scope": "lte", "trust": 0.8, "vendor": "buffalo", "version": "ver.1.04" }, { "model": "wex-300", "scope": "lte", "trust": 0.8, "vendor": "buffalo", "version": "ver.1.60" }, { "model": "whr-1166dhp", "scope": "lte", "trust": 0.8, "vendor": "buffalo", "version": "ver.1.60" }, { "model": "whr-300hp2", "scope": "lte", "trust": 0.8, "vendor": "buffalo", "version": "ver.1.60" }, { "model": "whr-600d", "scope": "lte", "trust": 0.8, "vendor": "buffalo", "version": "ver.1.60" }, { "model": "wmr-300", "scope": "lte", "trust": 0.8, "vendor": "buffalo", "version": "ver.1.60" }, { "model": "wsr-600dhp", "scope": "lte", "trust": 0.8, "vendor": "buffalo", "version": "ver.1.60" }, { "model": "whr-1166dhp", "scope": "lt", "trust": 0.6, "vendor": "buffalotech", "version": "1.60" }, { "model": "wsr-600dhp", "scope": "lt", "trust": 0.6, "vendor": "buffalotech", "version": "1.60" }, { "model": "whr-600d", "scope": "lt", "trust": 0.6, "vendor": "buffalotech", "version": "1.60" }, { "model": "whr-300hp2", "scope": "lt", "trust": 0.6, "vendor": "buffalotech", "version": "1.60" }, { "model": "wmr-300", "scope": "lt", "trust": 0.6, "vendor": "buffalotech", "version": "1.60" }, { "model": "wex-300", "scope": "lt", "trust": 0.6, "vendor": "buffalotech", "version": "1.60" }, { "model": "bhr-4grv2", "scope": "lt", "trust": 0.6, "vendor": "buffalotech", "version": "1.04" }, { "model": "wsr-600dhp", "scope": "eq", "trust": 0.6, "vendor": "buffalotech", "version": "1.60" }, { "model": "whr-1166dhp", "scope": "eq", "trust": 0.6, "vendor": "buffalotech", "version": "1.60" }, { "model": "whr-600d", "scope": "eq", "trust": 0.6, "vendor": "buffalotech", "version": "1.60" }, { "model": "bhr-4grv2", "scope": "eq", "trust": 0.6, "vendor": "buffalotech", "version": "1.04" }, { "model": "whr-300hp2", "scope": "eq", "trust": 0.6, "vendor": "buffalotech", "version": "1.60" }, { "model": "wex-300", "scope": "eq", "trust": 0.6, "vendor": "buffalotech", "version": "1.60" }, { "model": "wmr-300", "scope": "eq", "trust": 0.6, "vendor": "buffalotech", "version": "1.60" }, { "model": "technology wsr-600dhp", "scope": "eq", "trust": 0.3, "vendor": "buffalo", "version": "1.60" }, { "model": "technology wmr-300", "scope": "eq", "trust": 0.3, "vendor": "buffalo", "version": "1.60" }, { "model": "technology whr-600d", "scope": "eq", "trust": 0.3, "vendor": "buffalo", "version": "1.60" }, { "model": "technology whr-300hp2", "scope": "eq", "trust": 0.3, "vendor": "buffalo", "version": "1.60" }, { "model": "technology whr-1166dhp", "scope": "eq", "trust": 0.3, "vendor": "buffalo", "version": "1.60" }, { "model": "technology wex-300", "scope": "eq", "trust": 0.3, "vendor": "buffalo", "version": "1.60" }, { "model": "technology bhr-4grv2", "scope": "eq", "trust": 0.3, "vendor": "buffalo", "version": "1.04" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2015-03768" }, { "db": "BID", "id": "75062" }, { "db": "JVNDB", "id": "JVNDB-2015-000085" }, { "db": "CNNVD", "id": "CNNVD-201506-119" }, { "db": "NVD", "id": "CVE-2014-9284" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "cpe_match": [ { "cpe22Uri": "cpe:/h:buffalo_inc:bhr-4grv2", "vulnerable": true }, { "cpe22Uri": "cpe:/h:buffalo_inc:wex-300", "vulnerable": true }, { "cpe22Uri": "cpe:/h:buffalo_inc:whr-1166dhp", "vulnerable": true }, { "cpe22Uri": "cpe:/h:buffalo_inc:whr-300hp2", "vulnerable": true }, { "cpe22Uri": "cpe:/h:buffalo_inc:whr-600d", "vulnerable": true }, { "cpe22Uri": "cpe:/h:buffalo_inc:wmr-300", "vulnerable": true }, { "cpe22Uri": "cpe:/h:buffalo_inc:wsr-600dhp", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2015-000085" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Masashi Sakai, and Satoshi Ogawa.", "sources": [ { "db": "BID", "id": "75062" } ], "trust": 0.3 }, "cve": "CVE-2014-9284", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "SINGLE", "author": "nvd@nist.gov", "availabilityImpact": "COMPLETE", "baseScore": 7.7, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 5.1, "id": "CVE-2014-9284", "impactScore": 10.0, "integrityImpact": "COMPLETE", "severity": "HIGH", "trust": 1.0, "vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Low", "accessVector": "Adjacent Network", "authentication": "Single", "author": "IPA", "availabilityImpact": "Partial", "baseScore": 5.2, "confidentialityImpact": "Partial", "exploitabilityScore": null, "id": "JVNDB-2015-000085", "impactScore": null, "integrityImpact": "Partial", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "Medium", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "CNVD", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.0, "id": "CNVD-2015-03768", "impactScore": 6.4, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 0.6, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "SINGLE", "author": "VULHUB", "availabilityImpact": "COMPLETE", "baseScore": 7.7, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 5.1, "id": "VHN-77229", "impactScore": 10.0, "integrityImpact": "COMPLETE", "severity": "HIGH", "trust": 0.1, "vectorString": "AV:A/AC:L/AU:S/C:C/I:C/A:C", "version": "2.0" } ], "cvssV3": [], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2014-9284", "trust": 1.0, "value": "HIGH" }, { "author": "IPA", "id": "JVNDB-2015-000085", "trust": 0.8, "value": "Medium" }, { "author": "CNVD", "id": "CNVD-2015-03768", "trust": 0.6, "value": "MEDIUM" }, { "author": "CNNVD", "id": "CNNVD-201506-119", "trust": 0.6, "value": "HIGH" }, { "author": "VULHUB", "id": "VHN-77229", "trust": 0.1, "value": "HIGH" } ] } ], "sources": [ { "db": "CNVD", "id": "CNVD-2015-03768" }, { "db": "VULHUB", "id": "VHN-77229" }, { "db": "JVNDB", "id": "JVNDB-2015-000085" }, { "db": "CNNVD", "id": "CNNVD-201506-119" }, { "db": "NVD", "id": "CVE-2014-9284" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "The Buffalo WHR-1166DHP 1.60 and earlier, WSR-600DHP 1.60 and earlier, WHR-600D 1.60 and earlier, WHR-300HP2 1.60 and earlier, WMR-300 1.60 and earlier, WEX-300 1.60 and earlier, and BHR-4GRV2 1.04 and earlier routers allow remote authenticated users to execute arbitrary OS commands via unspecified vectors. Multiple wireless LAN routers provided by BUFFALO INC. contain an OS command injection vulnerability. Masashi Sakai, Satoshi Ogawa reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.An authenticated attacker may be able to execute arbitrary OS commands. Buffalo WHR-1166DHP, etc", "sources": [ { "db": "NVD", "id": "CVE-2014-9284" }, { "db": "JVNDB", "id": "JVNDB-2015-000085" }, { "db": "CNVD", "id": "CNVD-2015-03768" }, { "db": "BID", "id": "75062" }, { "db": "VULHUB", "id": "VHN-77229" } ], "trust": 2.52 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "JVN", "id": "JVN50447904", "trust": 3.4 }, { "db": "NVD", "id": "CVE-2014-9284", "trust": 3.4 }, { "db": "JVNDB", "id": "JVNDB-2015-000085", "trust": 3.4 }, { "db": "BID", "id": "75062", "trust": 1.0 }, { "db": "CNNVD", "id": "CNNVD-201506-119", "trust": 0.7 }, { "db": "CNVD", "id": "CNVD-2015-03768", "trust": 0.6 }, { "db": "VULHUB", "id": "VHN-77229", "trust": 0.1 } ], "sources": [ { "db": "CNVD", "id": "CNVD-2015-03768" }, { "db": "VULHUB", "id": "VHN-77229" }, { "db": "BID", "id": "75062" }, { "db": "JVNDB", "id": "JVNDB-2015-000085" }, { "db": "CNNVD", "id": "CNNVD-201506-119" }, { "db": "NVD", "id": "CVE-2014-9284" } ] }, "id": "VAR-201506-0008", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "CNVD", "id": "CNVD-2015-03768" }, { "db": "VULHUB", "id": "VHN-77229" } ], "trust": 1.338095253846154 }, "iot_taxonomy": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "category": [ "Network device" ], "sub_category": null, "trust": 0.6 } ], "sources": [ { "db": "CNVD", "id": "CNVD-2015-03768" } ] }, "last_update_date": "2024-11-23T22:59:36.301000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "BUFFALO INC. website", "trust": 0.8, "url": "http://www.buffalotech.com/select-your-region#" }, { "title": "Patches for arbitrary Buffalo router arbitrary command execution vulnerabilities", "trust": 0.6, "url": "https://www.cnvd.org.cn/patchInfo/show/59524" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2015-03768" }, { "db": "JVNDB", "id": "JVNDB-2015-000085" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-78", "trust": 1.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-77229" }, { "db": "JVNDB", "id": "JVNDB-2015-000085" }, { "db": "NVD", "id": "CVE-2014-9284" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 3.4, "url": "http://jvn.jp/en/jp/jvn50447904/index.html" }, { "trust": 1.7, "url": "http://jvndb.jvn.jp/jvndb/jvndb-2015-000085" }, { "trust": 0.9, "url": "http://jvndb.jvn.jp/en/contents/2015/jvndb-2015-000085.html" }, { "trust": 0.8, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-9284" }, { "trust": 0.8, "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-9284" }, { "trust": 0.3, "url": "http://www.buffalotech.com/" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2015-03768" }, { "db": "VULHUB", "id": "VHN-77229" }, { "db": "BID", "id": "75062" }, { "db": "JVNDB", "id": "JVNDB-2015-000085" }, { "db": "CNNVD", "id": "CNNVD-201506-119" }, { "db": "NVD", "id": "CVE-2014-9284" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "CNVD", "id": "CNVD-2015-03768" }, { "db": "VULHUB", "id": "VHN-77229" }, { "db": "BID", "id": "75062" }, { "db": "JVNDB", "id": "JVNDB-2015-000085" }, { "db": "CNNVD", "id": "CNNVD-201506-119" }, { "db": "NVD", "id": "CVE-2014-9284" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2015-06-12T00:00:00", "db": "CNVD", "id": "CNVD-2015-03768" }, { "date": "2015-06-09T00:00:00", "db": "VULHUB", "id": "VHN-77229" }, { "date": "2015-06-05T00:00:00", "db": "BID", "id": "75062" }, { "date": "2015-06-05T00:00:00", "db": "JVNDB", "id": "JVNDB-2015-000085" }, { "date": "2015-06-09T00:00:00", "db": "CNNVD", "id": "CNNVD-201506-119" }, { "date": "2015-06-09T00:59:00.073000", "db": "NVD", "id": "CVE-2014-9284" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2015-06-12T00:00:00", "db": "CNVD", "id": "CNVD-2015-03768" }, { "date": "2015-06-16T00:00:00", "db": "VULHUB", "id": "VHN-77229" }, { "date": "2015-06-05T00:00:00", "db": "BID", "id": "75062" }, { "date": "2015-06-10T00:00:00", "db": "JVNDB", "id": "JVNDB-2015-000085" }, { "date": "2015-06-09T00:00:00", "db": "CNNVD", "id": "CNNVD-201506-119" }, { "date": "2024-11-21T02:20:33.573000", "db": "NVD", "id": "CVE-2014-9284" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "specific network environment", "sources": [ { "db": "CNNVD", "id": "CNNVD-201506-119" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Multiple Buffalo wireless LAN routers vulnerable to OS command injection", "sources": [ { "db": "JVNDB", "id": "JVNDB-2015-000085" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "operating system commend injection", "sources": [ { "db": "CNNVD", "id": "CNNVD-201506-119" } ], "trust": 0.6 } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.