CVE-2011-1324: CSRF

Published May 9, 2011

Updated

Multiple cross-site request forgery (CSRF) vulnerabilities in the management screen on Buffalo WHR, WZR2, WZR, WER, and BBR series routers with firmware 1.x; BHR-4RV and FS-G54 routers with firmware 2.x; and AS-100 routers allow remote attackers to hijack the authentication of administrators for requests that modify settings, as demonstrated by changing the login password.

Affected Software

118 affected components

Buffalotech Bbr-4hg Firmware=1.02

Buffalotech Bbr-4hg Firmware=1.04

Buffalotech Bbr-4hg Firmware=1.04-beta

Buffalotech Bbr-4hg Firmware=1.10

Buffalotech Bbr-4hg Firmware=1.10-beta

Buffalotech Bbr-4hg Firmware=1.11-beta

Buffalotech Bbr-4hg Firmware=1.12

Buffalotech Bbr-4hg Firmware=1.20

Buffalotech Bbr-4hg Firmware=1.20-beta

Buffalotech Bbr-4hg Firmware=1.30

Buffalotech Bbr-4hg Firmware=1.30-beta

Buffalotech Bbr-4hg Firmware=1.31

Buffalotech Bbr-4hg Firmware=1.32

Buffalotech Bbr-4hg Firmware=1.32-beta

Buffalotech Bbr-4hg Firmware=1.33-beta

Buffalotech Bbr-4mg Firmware=1.00

Buffalotech Bbr-4mg Firmware=1.01-beta

Buffalotech Bbr-4mg Firmware=1.03

Buffalotech Bbr-4mg Firmware=1.04

Buffalotech Bbr-4mg Firmware=1.04-beta

Buffalotech Bbr-4mg Firmware=1.10

Buffalotech Bbr-4mg Firmware=1.10-beta

Buffalotech Bbr-4mg Firmware=1.11-beta

Buffalotech Bbr-4mg Firmware=1.12

Buffalotech Bbr-4mg Firmware=1.20

Buffalotech Bbr-4mg Firmware=1.20-beta

Buffalotech Bbr-4mg Firmware=1.30

Buffalotech Bbr-4mg Firmware=1.30-beta

Buffalotech Bbr-4mg Firmware=1.31

Buffalotech Bbr-4mg Firmware=1.32

Buffalotech Bbr-4mg Firmware=1.32-beta

Buffalotech Bbr-4mg Firmware=1.33

Buffalotech Bbr-4mg Firmware=1.33-beta

Buffalotech Bhr-4rv Firmware=2.31

Buffalotech Bhr-4rv Firmware=2.32-prebeta

Buffalotech Bhr-4rv Firmware=2.33-prebeta

Buffalotech Bhr-4rv Firmware=2.42

Buffalotech Bhr-4rv Firmware=2.46

Buffalotech Bhr-4rv Firmware=2.48

Buffalotech Fs-g54 Firmware=2.07

Buffalotech Wer-a54g54 Firmware=1.00

Buffalotech Wer-a54g54 Firmware=1.01-beta

Buffalotech Wer-a54g54 Firmware=1.02

Buffalotech Wer-a54g54 Firmware=1.03

Buffalotech Wer-a54g54 Firmware=1.10

Buffalotech Wer-a54g54 Firmware=1.12

Buffalotech Wer-a54g54 Firmware=1.12-beta

Buffalotech Wer-a54g54 Firmware=1.13

Buffalotech Wer-ag54 Firmware=1.04

Buffalotech Wer-ag54 Firmware=1.12

Buffalotech Wer-ag54 Firmware=1.12-beta

Buffalotech Wer-am54g54 Firmware=1.11

Buffalotech Wer-am54g54 Firmware=1.12

Buffalotech Wer-am54g54 Firmware=1.12-beta

Buffalotech Wer-am54g54 Firmware=1.13

Buffalotech Wer-am54g54 Firmware=1.14

Buffalotech Wer-amg54 Firmware=1.11

Buffalotech Wer-amg54 Firmware=1.12

Buffalotech Wer-amg54 Firmware=1.14

Buffalotech Whr-am54g54 Firmware=1.30

Buffalotech Whr-am54g54 Firmware=1.38

Buffalotech Whr-am54g54 Firmware=1.40

Buffalotech Whr-am54g54 Firmware=1.42

Buffalotech Whr-amg54 Firmware=1.31

Buffalotech Whr-amg54 Firmware=1.38

Buffalotech Whr-amg54 Firmware=1.40

Buffalotech Whr-amg54 Firmware=1.42

Buffalotech Whr-ampg Firmware=1.46

Buffalotech Whr-g Firmware=1.46

Buffalotech Whr-g54s Firmware=1.20

Buffalotech Whr-g54s Firmware=1.21

Buffalotech Whr-g54s Firmware=1.23

Buffalotech Whr-g54s Firmware=1.38

Buffalotech Whr-g54s Firmware=1.40

Buffalotech Whr-g54s Firmware=1.42

Buffalotech Whr-hp-ampg Firmware=1.32

Buffalotech Whr-hp-g Firmware=1.46

Buffalotech Whr-hp-g54 Firmware=1.20

Buffalotech Whr-hp-g54 Firmware=1.21

Buffalotech Whr-hp-g54 Firmware=1.23

Buffalotech Whr-hp-g54 Firmware=1.38

Buffalotech Whr-hp-g54 Firmware=1.40

Buffalotech Whr-hp-g54 Firmware=1.42

Buffalotech Wzr-ampg144nh Firmware=1.47

Buffalotech Wzr-ampg144nh Firmware=1.48-beta

Buffalotech Wzr-ampg300nh Firmware=1.48

Buffalotech Wzr-g144n Firmware=1.45

Buffalotech Wzr-g144n Firmware=1.46-beta

Buffalotech Wzr-g144n Firmware=1.47

Buffalotech Wzr-g144n Firmware=1.47-beta

Buffalotech Wzr-g144nh Firmware=1.45

Buffalotech Wzr-g144nh Firmware=1.47

Buffalotech Wzr-g144nh Firmware=1.47-beta

Buffalotech Wzr-g144nh Firmware=1.48

Buffalotech Wzr2-g300n Firmware=1.48

Buffalotech Wzr2-g300n Firmware=1.50-beta

Buffalotech As-100

Buffalotech Bbr-4hg

Buffalotech Bbr-4mg

Buffalotech Bhr-4rv

Buffalotech Fs-g54

Buffalotech Wer-a54g54

Buffalotech Wer-ag54

Buffalotech Wer-am54g54

Buffalotech Wer-amg54

Buffalotech Whr-am54g54

Buffalotech Whr-amg54

Buffalotech Whr-ampg

Buffalotech Whr-g

Buffalotech Whr-g54s

Buffalotech Whr-hp-ampg

Buffalotech Whr-hp-g

Buffalotech Whr-hp-g54

Buffalotech Wzr-ampg144nh

Buffalotech Wzr-ampg300nh

Buffalotech Wzr-g144n

Buffalotech Wzr-g144nh

Buffalotech Wzr2-g300n

Event History

May 9, 2011

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-1324?

CVE-2011-1324 is classified as a moderate severity vulnerability due to its potential to allow unauthorized access to the router's management capabilities.

How do I fix CVE-2011-1324?

To mitigate CVE-2011-1324, update your router firmware to the latest version provided by Buffalo Technology.

What devices are affected by CVE-2011-1324?

CVE-2011-1324 affects multiple Buffalo routers including WHR, WZR, BBR, and AS-100, specifically those with firmware versions 1.x and 2.x.

What type of attack does CVE-2011-1324 facilitate?

CVE-2011-1324 allows attackers to perform cross-site request forgery (CSRF) attacks, potentially enabling them to hijack the authentication of administrators.

Is there a workaround for CVE-2011-1324?

While firmware updates are the primary recommendation, minimizing exposure of the management interface to the internet may serve as a temporary workaround.