Password Storage Vulnerability in BUFFALO Wireless LAN Routers
CVE-2024-23486

9.8CRITICAL

Key Information:

Vendor: Buffalo Inc.
Status: Wsr-2533dHP; Wsr-2533dHPl; Wsr-2533dHP2; Wsr-a2533dHP2
Vendor: CVE Published:; 15 April 2024

🔔 Create Buffalo Inc. Vulnerability Alert

What is CVE-2024-23486?

A vulnerability in BUFFALO wireless LAN routers allows unauthenticated network-adjacent attackers to access stored credentials due to insecure plaintext password storage. Exploiting this flaw enables unauthorized users to retrieve sensitive login information from the product's configuration page, thereby compromising network security.

Affected Version(s)

WSR-2533DHP firmware Ver. 1.06 and earlier

WSR-2533DHP2 firmware Ver. 1.10 and earlier

WSR-2533DHPL firmware Ver. 1.06 and earlier

References

https://www.buffalo.jp/news/detail/20240410-01.html

https://jvn.jp/en/jp/JVN58236836/

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Apr 15, 2024
Vulnerability Reserved
Mar 19, 2024