NVD Vulnerability Detail
Search Exploit, PoC
CVE-2011-1324
Summary

Multiple cross-site request forgery (CSRF) vulnerabilities in the management screen on Buffalo WHR, WZR2, WZR, WER, and BBR series routers with firmware 1.x; BHR-4RV and FS-G54 routers with firmware 2.x; and AS-100 routers allow remote attackers to hijack the authentication of administrators for requests that modify settings, as demonstrated by changing the login password.

Publication Date May 10, 2011, 4:55 a.m.
Registration Date Jan. 28, 2021, 4:38 p.m.
Last Update Nov. 21, 2024, 10:26 a.m.
CVSS2.0 : MEDIUM
Score 5.8
Vector AV:N/AC:M/Au:N/C:N/I:P/A:P
攻撃元区分(AV) ネットワーク
攻撃条件の複雑さ(AC) 中
攻撃前の認証要否(Au) 不要
機密性への影響(C) なし
完全性への影響(I) 低
可用性への影響(A) 低
Get all privileges. いいえ
Get user privileges いいえ
Get other privileges いいえ
User operation required はい
Affected software configurations
Configuration1 or higher or less more than less than
cpe:2.3:a:buffalotech:bhr-4rv_firmware:2.46:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-amg54_firmware:1.42:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wer-amg54_firmware:1.14:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wer-amg54_firmware:1.11:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wer-ag54_firmware:1.12:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wzr-ampg144nh_firmware:1.47:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wzr-ampg300nh_firmware:1.48:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:fs-g54_firmware:2.07:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wer-a54g54_firmware:1.02:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wer-a54g54_firmware:1.12:beta:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wzr-ampg144nh_firmware:1.48:beta:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wer-a54g54_firmware:1.03:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-am54g54_firmware:1.40:*:*:*:*:*:*:*
cpe:2.3:h:buffalotech:bbr-4mg:*:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4mg_firmware:1.33:beta:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4mg_firmware:1.20:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4hg_firmware:1.30:beta:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4mg_firmware:1.12:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wer-a54g54_firmware:1.00:*:*:*:*:*:*:*
cpe:2.3:h:buffalotech:wzr-ampg300nh:*:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4mg_firmware:1.11:beta:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wzr2-g300n_firmware:1.50:beta:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bhr-4rv_firmware:2.48:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4mg_firmware:1.31:*:*:*:*:*:*:*
cpe:2.3:h:buffalotech:whr-hp-g54:*:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wzr-g144n_firmware:1.47:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-hp-g54_firmware:1.40:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-hp-g_firmware:1.46:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-g54s_firmware:1.20:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4mg_firmware:1.01:beta:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-amg54_firmware:1.40:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-ampg_firmware:1.46:*:*:*:*:*:*:*
cpe:2.3:h:buffalotech:wzr-g144nh:*:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4mg_firmware:1.10:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4hg_firmware:1.11:beta:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-g54s_firmware:1.40:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-amg54_firmware:1.38:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4hg_firmware:1.02:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-hp-g54_firmware:1.21:*:*:*:*:*:*:*
cpe:2.3:h:buffalotech:whr-ampg:*:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bhr-4rv_firmware:2.31:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4mg_firmware:1.32:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-am54g54_firmware:1.42:*:*:*:*:*:*:*
cpe:2.3:h:buffalotech:whr-amg54:*:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-hp-ampg_firmware:1.32:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-g54s_firmware:1.38:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4mg_firmware:1.00:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wzr-g144n_firmware:1.47:beta:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wzr-g144nh_firmware:1.47:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4mg_firmware:1.30:beta:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wer-am54g54_firmware:1.13:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4hg_firmware:1.10:beta:*:*:*:*:*:*
cpe:2.3:h:buffalotech:wer-a54g54:*:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bhr-4rv_firmware:2.42:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wzr-g144nh_firmware:1.48:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-g54s_firmware:1.23:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4mg_firmware:1.10:beta:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4hg_firmware:1.33:beta:*:*:*:*:*:*
cpe:2.3:h:buffalotech:wer-ag54:*:*:*:*:*:*:*:*
cpe:2.3:h:buffalotech:whr-g54s:*:*:*:*:*:*:*:*
cpe:2.3:h:buffalotech:wzr2-g300n:*:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wzr-g144nh_firmware:1.45:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-hp-g54_firmware:1.42:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4hg_firmware:1.31:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wer-am54g54_firmware:1.14:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bhr-4rv_firmware:2.33:prebeta:*:*:*:*:*:*
cpe:2.3:h:buffalotech:whr-am54g54:*:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-hp-g54_firmware:1.23:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-g_firmware:1.46:*:*:*:*:*:*:*
cpe:2.3:h:buffalotech:fs-g54:*:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4hg_firmware:1.10:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-hp-g54_firmware:1.38:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wer-ag54_firmware:1.12:beta:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wzr2-g300n_firmware:1.48:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4hg_firmware:1.20:beta:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4mg_firmware:1.32:beta:*:*:*:*:*:*
cpe:2.3:h:buffalotech:wzr-g144n:*:*:*:*:*:*:*:*
cpe:2.3:h:buffalotech:wer-am54g54:*:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wer-am54g54_firmware:1.11:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-g54s_firmware:1.21:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wer-a54g54_firmware:1.10:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4mg_firmware:1.03:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-hp-g54_firmware:1.20:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4mg_firmware:1.04:beta:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-g54s_firmware:1.42:*:*:*:*:*:*:*
cpe:2.3:h:buffalotech:bhr-4rv:*:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4mg_firmware:1.20:beta:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wzr-g144nh_firmware:1.47:beta:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wzr-g144n_firmware:1.45:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4hg_firmware:1.04:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4mg_firmware:1.30:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-am54g54_firmware:1.38:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4hg_firmware:1.20:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4mg_firmware:1.04:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wer-a54g54_firmware:1.13:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wer-am54g54_firmware:1.12:beta:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wer-a54g54_firmware:1.01:beta:*:*:*:*:*:*
cpe:2.3:h:buffalotech:whr-hp-g:*:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4hg_firmware:1.30:*:*:*:*:*:*:*
cpe:2.3:h:buffalotech:whr-hp-ampg:*:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wer-ag54_firmware:1.04:*:*:*:*:*:*:*
cpe:2.3:h:buffalotech:wer-amg54:*:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-am54g54_firmware:1.30:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wer-a54g54_firmware:1.12:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4hg_firmware:1.04:beta:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bhr-4rv_firmware:2.32:prebeta:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4mg_firmware:1.33:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wer-am54g54_firmware:1.12:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wer-amg54_firmware:1.12:*:*:*:*:*:*:*
cpe:2.3:h:buffalotech:wzr-ampg144nh:*:*:*:*:*:*:*:*
cpe:2.3:h:buffalotech:as-100:*:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:whr-amg54_firmware:1.31:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4hg_firmware:1.32:*:*:*:*:*:*:*
cpe:2.3:h:buffalotech:bbr-4hg:*:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:wzr-g144n_firmware:1.46:beta:*:*:*:*:*:*
cpe:2.3:h:buffalotech:whr-g:*:*:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4hg_firmware:1.32:beta:*:*:*:*:*:*
cpe:2.3:a:buffalotech:bbr-4hg_firmware:1.12:*:*:*:*:*:*:*
Related information, measures and tools
Common Vulnerabilities List
JVN Vulnerability Information
複数のバッファロー社製ルータにおけるクロスサイト・リクエスト・フォージェリの脆弱性
Title 複数のバッファロー社製ルータにおけるクロスサイト・リクエスト・フォージェリの脆弱性
Summary

株式会社バッファローが提供する複数のルータ製品のウェブ管理画面には、クロスサイトリクエストフォージェリの脆弱性が存在します。 株式会社バッファローが提供する複数のルータ製品には、ブラウザから各機能を設定できるウェブ管理画面があります。このウェブ管理画面には、クロスサイトリクエストフォージェリの脆弱性が存在します。 この脆弱性情報は、情報セキュリティ早期警戒パートナーシップに基づき下記の方が IPA に報告し、JPCERT/CC がベンダとの調整を行いました。 報告者: 片桐弘敬 氏

Possible impacts 当該製品の管理者が、ウェブ管理画面にログインした状態で悪意あるページを読み込んだ場合、パスワードなどの設定が変更される可能性があります。
Solution

[アップデートする] 開発者が提供する情報をもとに最新バージョンへアップデートしてください。 詳しくは開発者が提供する情報をご確認ください。
Publication Date April 19, 2011, midnight
Registration Date May 10, 2011, 10:55 a.m.
Last Update May 10, 2011, 10:55 a.m.
Affected System
バッファロー
BUFFALO BBR-4HG 他
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
その他
Change Log
No Changed Details Date of change
0 [2011年05月10日]
  掲載		 Feb. 17, 2018, 10:37 a.m.