CVE-2025-66954: Medium severity Buffalo LinkStation vulnerability

Published Apr 20, 2026

Updated

A vulnerability exists in the Buffalo Link Station version 1.85-0.01 that allows unauthenticated or guest-level users to enumerate valid usernames and their associated privilege roles. The issue is triggered by modifying a parameter within requests sent to the /nasapi endpoint.

Affected Software

1 affected component

Buffalo LinkStation=1.85-0.01

Event History

Apr 20, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·05:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-66954?

CVE-2025-66954 is considered a high severity vulnerability due to its potential for unauthorized access to sensitive information.

How can I fix CVE-2025-66954?

To fix CVE-2025-66954, update the Buffalo Link Station firmware to the latest version that addresses this vulnerability.

What type of users can exploit CVE-2025-66954?

CVE-2025-66954 can be exploited by unauthenticated or guest-level users who can send crafted requests to the device.

What is affected by CVE-2025-66954?

CVE-2025-66954 affects Buffalo Link Station version 1.85-0.01, allowing for enumeration of valid usernames and their roles.

What are the potential consequences of CVE-2025-66954?

The potential consequences of CVE-2025-66954 include unauthorized information disclosure that can lead to further attacks on the system.