CVE-2024-26023 Command injection in WCR-1166DS
A logged-in user can execute arbitrary OS commands on BUFFALO wireless LAN routers due to an OS command injection vulnerability.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-26023?
CVE-2024-26023 is a medium-severity command injection vulnerability in BUFFALO INC. WCR-1166DS, published on 15 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
OS command injection vulnerability in BUFFALO wireless LAN routers allows a logged-in user to execute arbitrary OS commands.
Weakness: CWE-78
Which versions are affected by CVE-2024-26023?
It affects 7 products.
Products include Buffalo Wcr-1166ds Firmware, Buffalo Wsr-1166dhp2 Firmware, Buffalo Wsr-1166dhp Firmware, Buffalo Wsr-2533dhp2 Firmware, Buffalo Wsr-2533dhp Firmware, Buffalo Wsr-2533dhpl Firmware and 1 more.
How do I fix CVE-2024-26023?
No fix has been published for CVE-2024-26023 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-26023 being exploited?
There is no known exploitation of CVE-2024-26023 in the wild and no public exploit code.
Other vulnerabilities in BUFFALO INC. WCR-1166DS
Sources
Also known as GHSA-pj4v-6cqj-7mvr.