CVE-2022-43443: OS Command Injection
Buffalo network devices WSR-3200AX4S firmware Ver. 1.26 and earlier, WSR-3200AX4B firmware Ver. 1.25, WSR-2533DHP firmware Ver. 1.08 and earlier, WSR-2533DHP2 firmware Ver. 1.22 and earlier, WSR-A2533DHP2 firmware Ver. 1.22 and earlier, WSR-2533DHP3 firmware Ver. 1.26 and earlier, WSR-A2533DHP3 firmware Ver. 1.26 and earlier, WSR-2533DHPL firmware Ver. 1.08 and earlier, WSR-2533DHPL2 firmware Ver. 1.03 and earlier, WSR-2533DHPLS firmware Ver. 1.07 and earlier, and WCR-1166DS firmware Ver. 1.34 and earlier allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted request is sent to the management page.
Other sources
OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted request is sent to the management page.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-43443?
The severity of CVE-2022-43443 is high, with a severity value of 8.8.
Which Buffalo network devices are affected by CVE-2022-43443?
Buffalo network devices WSR-3200AX4S firmware Ver. 1.26 and earlier, WSR-3200AX4B firmware Ver. 1.25, WSR-2533DHP firmware Ver. 1.08 and earlier, WSR-2533DHP2 firmware Ver. 1.22 and earlier, WSR-A2533DHP2 firmware Ver. 1.22 and earlier, WSR-2533DHP3 firmware Ver. 1.26 and earlier, WSR-A2533DHP3 firmware Ver. 1.26 and earlier are affected by CVE-2022-43443.
How can I fix CVE-2022-43443?
To fix CVE-2022-43443, update your Buffalo network device firmware to the latest version available.
Where can I find more information about CVE-2022-43443?
You can find more information about CVE-2022-43443 at the following references: [JVN](https://jvn.jp/en/vu/JVNVU97099584/index.html), [Buffalo](https://www.buffalo.jp/news/detail/20221205-01.html).
What is the CWE category of CVE-2022-43443?
The CWE category of CVE-2022-43443 is CWE-78 (Improper Neutralization of Special Elements used in an OS Command).