CVE-2026-29516 Buffalo TeraStation TS5400R Excessive File Permissions Information Disclosure
Authenticated attackers can read the /etc/shadow file to retrieve hashed passwords due to excessive file permissions on Buffalo TeraStation NAS devices.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-29516?
CVE-2026-29516 is a medium-severity vulnerability in Buffalo TeraStation NAS TS5400R, published on 16 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Buffalo TeraStation NAS TS5400R firmware version 4.02-0.06 and prior contain an excessive file permissions vulnerability that allows authenticated attackers to read the /etc/shadow file by uploading and executing a PHP file through the webserver. Attackers can exploit world-readable permissions on /etc/shadow to retrieve hashed passwords for all configured accounts including root.
Weakness: CWE-732
Which versions are affected by CVE-2026-29516?
It affects 1 product.
Products include Buffaloamericas Terastation Nas Ts5400r Firmware.
How do I fix CVE-2026-29516?
No fix has been published for CVE-2026-29516 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-29516 being exploited?
There is no known exploitation of CVE-2026-29516 in the wild and no public exploit code.
Sources
Also known as GHSA-p4fh-pgj9-w5xq.