CSRF in Buffalotech As-100
CVE-2011-1324
Multiple cross-site request forgery (CSRF) vulnerabilities in the management screen on Buffalo WHR, WZR2, WZR, WER, and BBR series routers with firmware 1.x; BHR-4RV and FS-G54 routers with firmware 2.x; and AS-100 routers allow remote attackers to hijack the authentication of administrators for requests that modify settings, as demonstrated by changing the login password.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.005 (38.4th percentile) — read the EPSS interpretation.
Affected products
- Buffalotech As-100
- Buffalotech Bbr-4hg
- Buffalotech Bbr-4hg_firmware — versions 1.02, 1.04, 1.10
- Buffalotech Bbr-4mg
- Buffalotech Bbr-4mg_firmware — versions 1.00, 1.01, 1.03
- Buffalotech Bhr-4rv
- Buffalotech Bhr-4rv_firmware — versions 2.31, 2.32, 2.33
- Buffalotech Fs-g54
- Buffalotech Fs-g54_firmware — versions 2.07
- Buffalotech Wer-a54g54
Weakness classification (CWE)
References
- vultures@jpcert.or.jp (x_refsource_JVN, third-party-advisory)
- vultures@jpcert.or.jp (x_refsource_CONFIRM)