Search criteria
4 vulnerabilities found for wmr-433 by buffalo
VAR-201601-0400
Vulnerability from variot - Updated: 2023-12-18 13:24Cross-site scripting (XSS) vulnerability on BUFFALO BHR-4GRV2 devices with firmware 1.04 and earlier, WEX-300 devices with firmware 1.90 and earlier, WHR-1166DHP devices with firmware 1.90 and earlier, WHR-300HP2 devices with firmware 1.90 and earlier, WHR-600D devices with firmware 1.90 and earlier, WMR-300 devices with firmware 1.90 and earlier, WMR-433 devices with firmware 1.01 and earlier, and WSR-1166DHP devices with firmware 1.01 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Multiple network devices provided by BUFFALO INC. contain a cross-site scripting vulnerability. Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.An arbitrary script may be executed on the logged in user's web browser. Buffalo is the wireless router product of the Buffalo Group. A remote attacker can exploit this vulnerability to inject arbitrary web scripts or HTML. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Buffalo BHR-4GRV2 etc
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201601-0400",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wex-300",
"scope": "eq",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.90"
},
{
"model": "wmr-433",
"scope": "eq",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.01"
},
{
"model": "whr-600d",
"scope": "eq",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.90"
},
{
"model": "wmr-300",
"scope": "eq",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.90"
},
{
"model": "whr-1166dhp",
"scope": "eq",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.90"
},
{
"model": "bhr-4grv2",
"scope": "eq",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.04"
},
{
"model": "wsr-1166dhp",
"scope": "eq",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.01"
},
{
"model": "whr-300hp2",
"scope": "eq",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.90"
},
{
"model": "bhr-4grv2",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.04"
},
{
"model": "wex-300",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.90"
},
{
"model": "whr-1166dhp",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.90"
},
{
"model": "whr-300hp2",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.90"
},
{
"model": "whr-600d",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.90"
},
{
"model": "wmr-300",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.90"
},
{
"model": "wmr-433",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.01"
},
{
"model": "wsr-1166dhp",
"scope": "eq",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.01"
},
{
"model": "bhr-4grv2",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.04"
},
{
"model": "wex-300",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.90"
},
{
"model": "whr-1166dhp",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.90"
},
{
"model": "whr-300hp2",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.90"
},
{
"model": "whr-600d",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.90"
},
{
"model": "wmr-300",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.90"
},
{
"model": "wmr-433",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.01"
},
{
"model": "wsr-1166dhp",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.01"
},
{
"model": "whr-600d",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "whr-300hp2",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "wex-300",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "whr-1166dhp",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "wmr-300",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "wsr-1166dhp",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "wmr-433",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "bhr-4grv2",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "technology wsr-1166dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.01"
},
{
"model": "technology wmr-300",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.90"
},
{
"model": "technology wmr-300",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology whr-600d",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.90"
},
{
"model": "technology whr-600d",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.80"
},
{
"model": "technology whr-600d",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.70"
},
{
"model": "technology whr-600d",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology whr-300hp2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.90"
},
{
"model": "technology whr-300hp2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.80"
},
{
"model": "technology whr-300hp2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.70"
},
{
"model": "technology whr-300hp2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology whr-1166dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.90"
},
{
"model": "technology whr-1166dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.80"
},
{
"model": "technology whr-1166dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.70"
},
{
"model": "technology whr-1166dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology wex-300",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.90"
},
{
"model": "technology wex-300",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology bhr-4grv2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.04"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00707"
},
{
"db": "BID",
"id": "81548"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000006"
},
{
"db": "NVD",
"id": "CVE-2016-1135"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-605"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:buffalotech:wmr-300:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:buffalotech:wmr-300_firmware:1.90:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:buffalotech:wex-300:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:buffalotech:wex-300_firmware:1.90:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:buffalotech:wmr-433:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:buffalotech:wmr-433_firmware:1.01:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:buffalotech:bhr-4grv2:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:buffalotech:bhr-4grv2_firmware:1.04:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:buffalotech:whr-300hp2:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:buffalotech:whr-300hp2_firmware:1.90:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:buffalotech:whr-1166dhp:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:buffalotech:whr-1166dhp_firmware:1.90:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:buffalotech:whr-600d:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:buffalotech:whr-600d_firmware:1.90:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:buffalotech:wsr-1166dhp:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:buffalotech:wsr-1166dhp_firmware:1.01:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2016-1135"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc.",
"sources": [
{
"db": "BID",
"id": "81548"
}
],
"trust": 0.3
},
"cve": "CVE-2016-1135",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2016-000006",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CNVD-2016-00707",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-89954",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 6.1,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "JVNDB-2016-000006",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "None",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2016-1135",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "IPA",
"id": "JVNDB-2016-000006",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2016-00707",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201601-605",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-89954",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00707"
},
{
"db": "VULHUB",
"id": "VHN-89954"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000006"
},
{
"db": "NVD",
"id": "CVE-2016-1135"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-605"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability on BUFFALO BHR-4GRV2 devices with firmware 1.04 and earlier, WEX-300 devices with firmware 1.90 and earlier, WHR-1166DHP devices with firmware 1.90 and earlier, WHR-300HP2 devices with firmware 1.90 and earlier, WHR-600D devices with firmware 1.90 and earlier, WMR-300 devices with firmware 1.90 and earlier, WMR-433 devices with firmware 1.01 and earlier, and WSR-1166DHP devices with firmware 1.01 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Multiple network devices provided by BUFFALO INC. contain a cross-site scripting vulnerability. Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.An arbitrary script may be executed on the logged in user\u0027s web browser. Buffalo is the wireless router product of the Buffalo Group. A remote attacker can exploit this vulnerability to inject arbitrary web scripts or HTML. \nAn attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Buffalo BHR-4GRV2 etc",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-1135"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000006"
},
{
"db": "CNVD",
"id": "CNVD-2016-00707"
},
{
"db": "BID",
"id": "81548"
},
{
"db": "VULHUB",
"id": "VHN-89954"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2016-1135",
"trust": 3.4
},
{
"db": "JVN",
"id": "JVN49225722",
"trust": 3.4
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000006",
"trust": 2.5
},
{
"db": "CNNVD",
"id": "CNNVD-201601-605",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2016-00707",
"trust": 0.6
},
{
"db": "BID",
"id": "81548",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-89954",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00707"
},
{
"db": "VULHUB",
"id": "VHN-89954"
},
{
"db": "BID",
"id": "81548"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000006"
},
{
"db": "NVD",
"id": "CVE-2016-1135"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-605"
}
]
},
"id": "VAR-201601-0400",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00707"
},
{
"db": "VULHUB",
"id": "VHN-89954"
}
],
"trust": 1.3471707
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00707"
}
]
},
"last_update_date": "2023-12-18T13:24:39.886000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "BUFFALO INC. website",
"trust": 0.8,
"url": "http://buffalo.jp/support_s/s20141030_2.html"
},
{
"title": "Patches for multiple Buffalo product cross-site scripting vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/70910"
},
{
"title": "Multiple Buffalo Fixes for product cross-site scripting vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=59923"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00707"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000006"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-605"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-89954"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000006"
},
{
"db": "NVD",
"id": "CVE-2016-1135"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "http://jvn.jp/en/jp/jvn49225722/index.html"
},
{
"trust": 1.7,
"url": "http://jvndb.jvn.jp/jvndb/jvndb-2016-000006"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1135"
},
{
"trust": 0.8,
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1135"
},
{
"trust": 0.3,
"url": "http://www.buffalotech.com/products/wireless/wireless-n-routers-access-points/"
},
{
"trust": 0.3,
"url": "http://www.buffalotech.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00707"
},
{
"db": "VULHUB",
"id": "VHN-89954"
},
{
"db": "BID",
"id": "81548"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000006"
},
{
"db": "NVD",
"id": "CVE-2016-1135"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-605"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2016-00707"
},
{
"db": "VULHUB",
"id": "VHN-89954"
},
{
"db": "BID",
"id": "81548"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000006"
},
{
"db": "NVD",
"id": "CVE-2016-1135"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-605"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-01-29T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-00707"
},
{
"date": "2016-01-22T00:00:00",
"db": "VULHUB",
"id": "VHN-89954"
},
{
"date": "2016-01-22T00:00:00",
"db": "BID",
"id": "81548"
},
{
"date": "2016-01-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-000006"
},
{
"date": "2016-01-22T11:59:06.307000",
"db": "NVD",
"id": "CVE-2016-1135"
},
{
"date": "2016-01-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201601-605"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-01-29T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-00707"
},
{
"date": "2016-03-11T00:00:00",
"db": "VULHUB",
"id": "VHN-89954"
},
{
"date": "2016-01-22T00:00:00",
"db": "BID",
"id": "81548"
},
{
"date": "2016-03-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-000006"
},
{
"date": "2016-03-11T13:26:22.597000",
"db": "NVD",
"id": "CVE-2016-1135"
},
{
"date": "2016-01-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201601-605"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201601-605"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple Buffalo network devices vulnerable to cross-site scripting",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-000006"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201601-605"
}
],
"trust": 0.6
}
}
VAR-201707-0318
Vulnerability from variot - Updated: 2023-12-18 13:14Cross-site request forgery (CSRF) vulnerability in WMR-433 firmware Ver.1.02 and earlier, WMR-433W firmware Ver.1.40 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors. WMR-433 and WMR-433W provided by BUFFALO INC. are wireless LAN routers. WMR-433 and WMR-433W contain multiple vulnerabilities listed below. * Cross-site Request Forgery (CWE-352) - CVE-2017-2273 * Reflected Cross-site Scripting (CWE-79) - CVE-2017-2274 Manabu Kobayashi reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.The possible impact of each vulnerability is as follows: * If a logged-in user accesses a specially crafted page, configuration of the device may be changed or the device may be rebooted - CVE-2017-2273 * If a logged-in user accesses a specially crafted page, an arbitrary script may be executed on the user's web browser - CVE-2017-2274. Both the BUFFALOWAPM-1166D and the WAPM-APG600H are wireless LAN access point devices from Japan's BUFFALO Corporation. A remote attacker could exploit this vulnerability to perform unauthorized operations
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201707-0318",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wmr-433w",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.40"
},
{
"model": "wmr-433",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.02"
},
{
"model": "wmr-433",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.02"
},
{
"model": "wmr-433w",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.40"
},
{
"model": "wmr-433",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.02"
},
{
"model": "wmr-433w",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.40"
},
{
"model": "wmr-433",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalo",
"version": "1.02"
},
{
"model": "wmr-433w",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalo",
"version": "1.40"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-24402"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"db": "NVD",
"id": "CVE-2017-2273"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-1102"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:buffalo:wmr-433_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.02",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:buffalo:wmr-433:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:buffalo:wmr-433w_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.40",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:buffalo:wmr-433w:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-2273"
}
]
},
"cve": "CVE-2017-2273",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "Partial",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2017-000180",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2017-000180",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2017-24402",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-110476",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "IPA",
"availabilityImpact": "Low",
"baseScore": 4.3,
"baseSeverity": "Medium",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2017-000180",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 6.1,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "JVNDB-2017-000180",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "None",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "IPA",
"id": "JVNDB-2017-000180",
"trust": 1.6,
"value": "Medium"
},
{
"author": "NVD",
"id": "CVE-2017-2273",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2017-24402",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201707-1102",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-110476",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-24402"
},
{
"db": "VULHUB",
"id": "VHN-110476"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"db": "NVD",
"id": "CVE-2017-2273"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-1102"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site request forgery (CSRF) vulnerability in WMR-433 firmware Ver.1.02 and earlier, WMR-433W firmware Ver.1.40 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors. WMR-433 and WMR-433W provided by BUFFALO INC. are wireless LAN routers. WMR-433 and WMR-433W contain multiple vulnerabilities listed below. * Cross-site Request Forgery (CWE-352) - CVE-2017-2273 * Reflected Cross-site Scripting (CWE-79) - CVE-2017-2274 Manabu Kobayashi reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.The possible impact of each vulnerability is as follows: * If a logged-in user accesses a specially crafted page, configuration of the device may be changed or the device may be rebooted - CVE-2017-2273 * If a logged-in user accesses a specially crafted page, an arbitrary script may be executed on the user\u0027s web browser - CVE-2017-2274. Both the BUFFALOWAPM-1166D and the WAPM-APG600H are wireless LAN access point devices from Japan\u0027s BUFFALO Corporation. A remote attacker could exploit this vulnerability to perform unauthorized operations",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-2273"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"db": "CNVD",
"id": "CNVD-2017-24402"
},
{
"db": "VULHUB",
"id": "VHN-110476"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "JVN",
"id": "JVN48413726",
"trust": 3.1
},
{
"db": "NVD",
"id": "CVE-2017-2273",
"trust": 3.1
},
{
"db": "JVNDB",
"id": "JVNDB-2017-000180",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201707-1102",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2017-24402",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-110476",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-24402"
},
{
"db": "VULHUB",
"id": "VHN-110476"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"db": "NVD",
"id": "CVE-2017-2273"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-1102"
}
]
},
"id": "VAR-201707-0318",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-24402"
},
{
"db": "VULHUB",
"id": "VHN-110476"
}
],
"trust": 1.362337665
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-24402"
}
]
},
"last_update_date": "2023-12-18T13:14:14.482000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "BUFFALO INC. website",
"trust": 0.8,
"url": "http://buffalo.jp/support_s/s20170606.html"
},
{
"title": "Patch for BUFFALOWAPM-1166D and WAPM-APG600H Cross-Site Request Forgery Vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/101439"
},
{
"title": "BUFFALO WAPM-1166D and WAPM-APG600H Fixes for cross-site request forgery vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=71988"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-24402"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-1102"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.9
},
{
"problemtype": "CWE-79",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-110476"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"db": "NVD",
"id": "CVE-2017-2273"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://jvn.jp/en/jp/jvn48413726/index.html"
},
{
"trust": 1.7,
"url": "http://buffalo.jp/support_s/s20170606.html"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-2273"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-2274"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-2273"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-2274"
},
{
"trust": 0.6,
"url": "http://jvn.jp/en/jp/jvn48413726/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-24402"
},
{
"db": "VULHUB",
"id": "VHN-110476"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"db": "NVD",
"id": "CVE-2017-2273"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-1102"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2017-24402"
},
{
"db": "VULHUB",
"id": "VHN-110476"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"db": "NVD",
"id": "CVE-2017-2273"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-1102"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-24402"
},
{
"date": "2017-07-22T00:00:00",
"db": "VULHUB",
"id": "VHN-110476"
},
{
"date": "2017-07-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"date": "2017-07-22T00:29:00.233000",
"db": "NVD",
"id": "CVE-2017-2273"
},
{
"date": "2017-07-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201707-1102"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-24402"
},
{
"date": "2017-08-10T00:00:00",
"db": "VULHUB",
"id": "VHN-110476"
},
{
"date": "2018-01-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"date": "2017-08-10T15:55:22.193000",
"db": "NVD",
"id": "CVE-2017-2273"
},
{
"date": "2022-03-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201707-1102"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201707-1102"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple vulnerabilities in multiple Buffalo wireless LAN routers",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-000180"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201707-1102"
}
],
"trust": 0.6
}
}
VAR-201707-0319
Vulnerability from variot - Updated: 2023-12-18 13:14Cross-site scripting vulnerability in WMR-433 firmware Ver.1.02 and earlier, WMR-433W firmware Ver.1.40 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. WMR-433 and WMR-433W provided by BUFFALO INC. are wireless LAN routers. WMR-433 and WMR-433W contain multiple vulnerabilities listed below. * Cross-site Request Forgery (CWE-352) - CVE-2017-2273 * Reflected Cross-site Scripting (CWE-79) - CVE-2017-2274 Manabu Kobayashi reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.The possible impact of each vulnerability is as follows: * If a logged-in user accesses a specially crafted page, configuration of the device may be changed or the device may be rebooted - CVE-2017-2273 * If a logged-in user accesses a specially crafted page, an arbitrary script may be executed on the user's web browser - CVE-2017-2274. Both the BUFFALOWAPM-1166D and the WAPM-APG600H are wireless LAN access point devices from Japan's BUFFALO Corporation
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201707-0319",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wmr-433w",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.40"
},
{
"model": "wmr-433",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalo",
"version": "1.02"
},
{
"model": "wmr-433",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.02"
},
{
"model": "wmr-433w",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.40"
},
{
"model": "wmr-433",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.02"
},
{
"model": "wmr-433w",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.40"
},
{
"model": "wmr-433",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalo",
"version": "1.02"
},
{
"model": "wmr-433w",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalo",
"version": "1.40"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-24401"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"db": "NVD",
"id": "CVE-2017-2274"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-1101"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:buffalo:wmr-433_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.02",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:buffalo:wmr-433:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:buffalo:wmr-433w_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.40",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:buffalo:wmr-433w:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-2274"
}
]
},
"cve": "CVE-2017-2274",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "Partial",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2017-000180",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2017-000180",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CNVD-2017-24401",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-110477",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "IPA",
"availabilityImpact": "Low",
"baseScore": 4.3,
"baseSeverity": "Medium",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2017-000180",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 6.1,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "JVNDB-2017-000180",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "None",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "IPA",
"id": "JVNDB-2017-000180",
"trust": 1.6,
"value": "Medium"
},
{
"author": "NVD",
"id": "CVE-2017-2274",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2017-24401",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201707-1101",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-110477",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-24401"
},
{
"db": "VULHUB",
"id": "VHN-110477"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"db": "NVD",
"id": "CVE-2017-2274"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-1101"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting vulnerability in WMR-433 firmware Ver.1.02 and earlier, WMR-433W firmware Ver.1.40 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. WMR-433 and WMR-433W provided by BUFFALO INC. are wireless LAN routers. WMR-433 and WMR-433W contain multiple vulnerabilities listed below. * Cross-site Request Forgery (CWE-352) - CVE-2017-2273 * Reflected Cross-site Scripting (CWE-79) - CVE-2017-2274 Manabu Kobayashi reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.The possible impact of each vulnerability is as follows: * If a logged-in user accesses a specially crafted page, configuration of the device may be changed or the device may be rebooted - CVE-2017-2273 * If a logged-in user accesses a specially crafted page, an arbitrary script may be executed on the user\u0027s web browser - CVE-2017-2274. Both the BUFFALOWAPM-1166D and the WAPM-APG600H are wireless LAN access point devices from Japan\u0027s BUFFALO Corporation",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-2274"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"db": "CNVD",
"id": "CNVD-2017-24401"
},
{
"db": "VULHUB",
"id": "VHN-110477"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-2274",
"trust": 3.1
},
{
"db": "JVN",
"id": "JVN48413726",
"trust": 3.1
},
{
"db": "JVNDB",
"id": "JVNDB-2017-000180",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201707-1101",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2017-24401",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-110477",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-24401"
},
{
"db": "VULHUB",
"id": "VHN-110477"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"db": "NVD",
"id": "CVE-2017-2274"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-1101"
}
]
},
"id": "VAR-201707-0319",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-24401"
},
{
"db": "VULHUB",
"id": "VHN-110477"
}
],
"trust": 1.362337665
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-24401"
}
]
},
"last_update_date": "2023-12-18T13:14:14.453000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "BUFFALO INC. website",
"trust": 0.8,
"url": "http://buffalo.jp/support_s/s20170606.html"
},
{
"title": "Patch for BUFFALOWAPM-1166D and WAPM-APG600H Cross-Site Scripting Vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/101438"
},
{
"title": "BUFFALO WAPM-1166D and WAPM-APG600H Fixes for cross-site scripting vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=71987"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-24401"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-1101"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
},
{
"problemtype": "CWE-352",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-110477"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"db": "NVD",
"id": "CVE-2017-2274"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://jvn.jp/en/jp/jvn48413726/index.html"
},
{
"trust": 1.7,
"url": "http://buffalo.jp/support_s/s20170606.html"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-2273"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-2274"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-2273"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-2274"
},
{
"trust": 0.6,
"url": "http://jvn.jp/en/jp/jvn48413726/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-24401"
},
{
"db": "VULHUB",
"id": "VHN-110477"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"db": "NVD",
"id": "CVE-2017-2274"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-1101"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2017-24401"
},
{
"db": "VULHUB",
"id": "VHN-110477"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"db": "NVD",
"id": "CVE-2017-2274"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-1101"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-24401"
},
{
"date": "2017-07-22T00:00:00",
"db": "VULHUB",
"id": "VHN-110477"
},
{
"date": "2017-07-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"date": "2017-07-22T00:29:00.277000",
"db": "NVD",
"id": "CVE-2017-2274"
},
{
"date": "2017-07-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201707-1101"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-24401"
},
{
"date": "2017-11-08T00:00:00",
"db": "VULHUB",
"id": "VHN-110477"
},
{
"date": "2018-01-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-000180"
},
{
"date": "2017-11-08T15:54:22.983000",
"db": "NVD",
"id": "CVE-2017-2274"
},
{
"date": "2022-03-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201707-1101"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201707-1101"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple vulnerabilities in multiple Buffalo wireless LAN routers",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-000180"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201707-1101"
}
],
"trust": 0.6
}
}
VAR-201601-0399
Vulnerability from variot - Updated: 2023-12-18 12:20Cross-site request forgery (CSRF) vulnerability on BUFFALO BHR-4GRV2 devices with firmware 1.04 and earlier, WEX-300 devices with firmware 1.90 and earlier, WHR-1166DHP devices with firmware 1.90 and earlier, WHR-300HP2 devices with firmware 1.90 and earlier, WHR-600D devices with firmware 1.90 and earlier, WMR-300 devices with firmware 1.90 and earlier, WMR-433 devices with firmware 1.01 and earlier, and WSR-1166DHP devices with firmware 1.01 and earlier allows remote attackers to hijack the authentication of arbitrary users. Multiple network devices provided by BUFFALO INC. contain a cross-site request forgery vulnerability (CWE-352). Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. and Masashi Sakai reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.If a user views a malicious page while logged in, unintended operations may be conducted. Buffalo BHR-4GRV2 and so on are all wireless router products of Buffalo Group of Japan. A remote attacker could exploit this vulnerability to perform unauthorized operations. This may aid in other attacks. Buffalo BHR-4GRV2 etc
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201601-0399",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "whr-1166dhp",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.90"
},
{
"model": "bhr-4grv2",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.04"
},
{
"model": "wsr-1166dhp",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.01"
},
{
"model": "wex-300",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.90"
},
{
"model": "whr-600d",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.90"
},
{
"model": "wmr-433",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.01"
},
{
"model": "whr-300hp2",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.90"
},
{
"model": "wmr-300",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.90"
},
{
"model": "bhr-4grv2",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.04"
},
{
"model": "wex-300",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.90"
},
{
"model": "whr-1166dhp",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.90"
},
{
"model": "whr-300hp2",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.90"
},
{
"model": "whr-600d",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.90"
},
{
"model": "wmr-300",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.90"
},
{
"model": "wmr-433",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.01"
},
{
"model": "wsr-1166dhp",
"scope": "eq",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.01"
},
{
"model": "bhr-4grv2",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.04"
},
{
"model": "wex-300",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.90"
},
{
"model": "whr-1166dhp",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.90"
},
{
"model": "whr-300hp2",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.90"
},
{
"model": "whr-600d",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.90"
},
{
"model": "wmr-300",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.90"
},
{
"model": "wmr-433",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.01"
},
{
"model": "wsr-1166dhp",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.01"
},
{
"model": "whr-600d",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "whr-300hp2",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "wex-300",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "whr-1166dhp",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "wmr-300",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "wsr-1166dhp",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "wmr-433",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "bhr-4grv2",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "technology wsr-1166dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.01"
},
{
"model": "technology wmr-433",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.01"
},
{
"model": "technology wmr-300",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.90"
},
{
"model": "technology wmr-300",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology whr-600d",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.90"
},
{
"model": "technology whr-600d",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.80"
},
{
"model": "technology whr-600d",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.70"
},
{
"model": "technology whr-600d",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology whr-300hp2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.90"
},
{
"model": "technology whr-300hp2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.80"
},
{
"model": "technology whr-300hp2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.70"
},
{
"model": "technology whr-300hp2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology whr-1166dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.90"
},
{
"model": "technology whr-1166dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.80"
},
{
"model": "technology whr-1166dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.70"
},
{
"model": "technology whr-1166dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology wex-300",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.90"
},
{
"model": "technology wex-300",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology bhr-4grv2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.04"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00775"
},
{
"db": "BID",
"id": "81550"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000005"
},
{
"db": "NVD",
"id": "CVE-2016-1134"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-604"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:buffalotech:whr-1166dhp:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:buffalotech:whr-1166dhp_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.90",
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:buffalotech:whr-300hp2:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:buffalotech:whr-300hp2_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.90",
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:buffalotech:wmr-300:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:buffalotech:wmr-300_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.90",
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:buffalotech:bhr-4grv2:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:buffalotech:bhr-4grv2_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.04",
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:buffalotech:wex-300:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:buffalotech:wex-300_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.90",
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:buffalotech:whr-600d:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:buffalotech:whr-600d_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.90",
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:buffalotech:wmr-433:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:buffalotech:wmr-433_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.01",
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:buffalotech:wsr-1166dhp:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:buffalotech:wsr-1166dhp_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.01",
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2016-1134"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. and Masashi Sakai",
"sources": [
{
"db": "BID",
"id": "81550"
}
],
"trust": 0.3
},
"cve": "CVE-2016-1134",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "High",
"accessVector": "Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 2.6,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2016-000005",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"exploitabilityScore": 4.9,
"id": "CNVD-2016-00775",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-89953",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 4.3,
"baseSeverity": "Medium",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2016-000005",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2016-1134",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "IPA",
"id": "JVNDB-2016-000005",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2016-00775",
"trust": 0.6,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-201601-604",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-89953",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00775"
},
{
"db": "VULHUB",
"id": "VHN-89953"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000005"
},
{
"db": "NVD",
"id": "CVE-2016-1134"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-604"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site request forgery (CSRF) vulnerability on BUFFALO BHR-4GRV2 devices with firmware 1.04 and earlier, WEX-300 devices with firmware 1.90 and earlier, WHR-1166DHP devices with firmware 1.90 and earlier, WHR-300HP2 devices with firmware 1.90 and earlier, WHR-600D devices with firmware 1.90 and earlier, WMR-300 devices with firmware 1.90 and earlier, WMR-433 devices with firmware 1.01 and earlier, and WSR-1166DHP devices with firmware 1.01 and earlier allows remote attackers to hijack the authentication of arbitrary users. Multiple network devices provided by BUFFALO INC. contain a cross-site request forgery vulnerability (CWE-352). Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. and Masashi Sakai reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.If a user views a malicious page while logged in, unintended operations may be conducted. Buffalo BHR-4GRV2 and so on are all wireless router products of Buffalo Group of Japan. A remote attacker could exploit this vulnerability to perform unauthorized operations. This may aid in other attacks. Buffalo BHR-4GRV2 etc",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-1134"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000005"
},
{
"db": "CNVD",
"id": "CNVD-2016-00775"
},
{
"db": "BID",
"id": "81550"
},
{
"db": "VULHUB",
"id": "VHN-89953"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2016-1134",
"trust": 3.4
},
{
"db": "JVN",
"id": "JVN09268287",
"trust": 2.8
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000005",
"trust": 2.5
},
{
"db": "CNNVD",
"id": "CNNVD-201601-604",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2016-00775",
"trust": 0.6
},
{
"db": "BID",
"id": "81550",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-89953",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00775"
},
{
"db": "VULHUB",
"id": "VHN-89953"
},
{
"db": "BID",
"id": "81550"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000005"
},
{
"db": "NVD",
"id": "CVE-2016-1134"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-604"
}
]
},
"id": "VAR-201601-0399",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00775"
},
{
"db": "VULHUB",
"id": "VHN-89953"
}
],
"trust": 1.3471707
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00775"
}
]
},
"last_update_date": "2023-12-18T12:20:38.407000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "BUFFALO INC. website",
"trust": 0.8,
"url": "http://buffalo.jp/support_s/s20141030_1.html"
},
{
"title": "Patches for cross-site request forgery vulnerabilities for multiple Buffalo devices",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/71069"
},
{
"title": "Multiple Buffalo Fixing measures for device cross-site request forgery vulnerability",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=59922"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00775"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000005"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-604"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-89953"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000005"
},
{
"db": "NVD",
"id": "CVE-2016-1134"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.8,
"url": "http://jvn.jp/en/jp/jvn09268287/index.html"
},
{
"trust": 1.7,
"url": "http://jvndb.jvn.jp/jvndb/jvndb-2016-000005"
},
{
"trust": 1.4,
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1134"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1134"
},
{
"trust": 0.3,
"url": "http://www.buffalotech.com/products/wireless/wireless-n-routers-access-points/"
},
{
"trust": 0.3,
"url": "http://www.buffalotech.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00775"
},
{
"db": "VULHUB",
"id": "VHN-89953"
},
{
"db": "BID",
"id": "81550"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000005"
},
{
"db": "NVD",
"id": "CVE-2016-1134"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-604"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2016-00775"
},
{
"db": "VULHUB",
"id": "VHN-89953"
},
{
"db": "BID",
"id": "81550"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000005"
},
{
"db": "NVD",
"id": "CVE-2016-1134"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-604"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-02-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-00775"
},
{
"date": "2016-01-22T00:00:00",
"db": "VULHUB",
"id": "VHN-89953"
},
{
"date": "2016-01-22T00:00:00",
"db": "BID",
"id": "81550"
},
{
"date": "2016-01-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-000005"
},
{
"date": "2016-01-22T11:59:05.117000",
"db": "NVD",
"id": "CVE-2016-1134"
},
{
"date": "2016-01-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201601-604"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-02-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-00775"
},
{
"date": "2016-03-14T00:00:00",
"db": "VULHUB",
"id": "VHN-89953"
},
{
"date": "2016-01-22T00:00:00",
"db": "BID",
"id": "81550"
},
{
"date": "2016-03-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-000005"
},
{
"date": "2016-03-14T15:58:21.987000",
"db": "NVD",
"id": "CVE-2016-1134"
},
{
"date": "2016-01-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201601-604"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201601-604"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple Buffalo network devices vulnerable to cross-site request forgery",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-000005"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201601-604"
}
],
"trust": 0.6
}
}