CVE-2021-20731 Command injection in WSR-1166DHP3 and WSR-1166DHP4
Attackers can execute arbitrary OS commands with root privileges on Buffalo WSR-1166DHP3 and DHP4 routers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20731?
CVE-2021-20731 is a high-severity command injection vulnerability in BUFFALO INC. WSR-1166DHP3 and WSR-1166DHP4, published on 9 Jun 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
WSR-1166DHP3 firmware Ver.1.16 and prior and WSR-1166DHP4 firmware Ver.1.02 and prior allow an attacker to execute arbitrary OS commands with root privileges via unspecified vectors.
Weakness: CWE-78
Which versions are affected by CVE-2021-20731?
It affects 2 products.
Products include Buffalo Wsr-1166dhp3 Firmware, Buffalo Wsr-1166dhp4 Firmware.
How do I fix CVE-2021-20731?
No fix has been published for CVE-2021-20731 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-20731 being exploited?
There is no known exploitation of CVE-2021-20731 in the wild and no public exploit code.
Other vulnerabilities in BUFFALO INC. WSR-1166DHP3 and WSR-1166DHP4
Sources
Also known as GHSA-35wj-mf36-r4h7.