{"id":"CVE-2022-43443","aliases":["EUVD-2022-46445","GHSA-242r-mxxc-q586"],"status":"published","title":"Buffalo network devices WSR-3200AX4S firmware Ver. 1.26 and earlier, WSR-3200AX4B firmware Ver. 1...","description":"OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted request is sent to the management page.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00784,"percentile":0.56477,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2022-12-19T00:00:00Z","modified":"2026-06-17T05:06:33Z","products":[{"vendor":"buffalo","product":"wcr-1166ds_firmware"},{"vendor":"buffalo","product":"wsr-2533dhp2_firmware"},{"vendor":"buffalo","product":"wsr-2533dhp3_firmware"},{"vendor":"buffalo","product":"wsr-2533dhp_firmware"},{"vendor":"buffalo","product":"wsr-2533dhpl2_firmware"},{"vendor":"buffalo","product":"wsr-2533dhpl_firmware"},{"vendor":"buffalo","product":"wsr-2533dhpls_firmware"},{"vendor":"buffalo","product":"wsr-3200ax4b_firmware"},{"vendor":"buffalo","product":"wsr-3200ax4s_firmware"},{"vendor":"buffalo","product":"wsr-a2533dhp2_firmware"},{"vendor":"buffalo","product":"wsr-a2533dhp3_firmware"},{"vendor":"buffalo inc.","product":"wcr-1166ds"},{"vendor":"buffalo inc.","product":"wsr-1166dhp"},{"vendor":"buffalo inc.","product":"wsr-1166dhp2"},{"vendor":"buffalo inc.","product":"wsr-2533dhp"},{"vendor":"buffalo inc.","product":"wsr-2533dhp2"},{"vendor":"buffalo inc.","product":"wsr-2533dhp3"},{"vendor":"buffalo inc.","product":"wsr-2533dhpl"},{"vendor":"buffalo inc.","product":"wsr-2533dhpl2"},{"vendor":"buffalo inc.","product":"wsr-2533dhplb"},{"vendor":"buffalo inc.","product":"wsr-2533dhpls"},{"vendor":"buffalo inc.","product":"wsr-3200ax4b"},{"vendor":"buffalo inc.","product":"wsr-3200ax4s"},{"vendor":"buffalo inc.","product":"wsr-a2533dhp2"},{"vendor":"buffalo inc.","product":"wsr-a2533dhp3"},{"vendor":"buffalo inc.","product":"wxr-11000xe12"},{"vendor":"buffalo inc.","product":"wxr-5700ax7b"},{"vendor":"buffalo inc.","product":"wxr-5700ax7s"}],"references":[{"url":"https://www.buffalo.jp/news/detail/20240131-01.html","tags":["x_transferred"]},{"url":"https://jvn.jp/en/vu/JVNVU97099584/","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43443"},{"url":"https://jvn.jp/en/vu/JVNVU97099584/index.html"},{"url":"https://www.buffalo.jp/news/detail/20221205-01.html"},{"url":"https://jvn.jp/en/vu/JVNVU97099584"},{"url":"https://github.com/advisories/GHSA-242r-mxxc-q586"}],"sources":{"cve":[{"id":"CVE-2022-43443","description":"OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted request is sent to the management page.","status":"published","published":"2022-12-19T00:00:00Z","modified":"2025-04-17T14:54:48.368Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:25.308772Z"}],"euvd":[{"id":"EUVD-2022-46445","description":"OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted request is sent to the management page.","status":"published","published":"2022-12-19T00:00:00Z","modified":"2025-04-17T14:54:48Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:21.593744Z"}],"ghsa":[{"id":"GHSA-242r-mxxc-q586","title":"Buffalo network devices WSR-3200AX4S firmware Ver. 1.26 and earlier, WSR-3200AX4B firmware Ver. 1...","description":"Buffalo network devices WSR-3200AX4S firmware Ver. 1.26 and earlier, WSR-3200AX4B firmware Ver. 1.25, WSR-2533DHP firmware Ver. 1.08 and earlier, WSR-2533DHP2 firmware Ver. 1.22 and earlier, WSR-A2533DHP2 firmware Ver. 1.22 and earlier, WSR-2533DHP3 firmware Ver. 1.26 and earlier, WSR-A2533DHP3 firmware Ver. 1.26 and earlier, WSR-2533DHPL firmware Ver. 1.08 and earlier, WSR-2533DHPL2 firmware Ver. 1.03 and earlier, WSR-2533DHPLS firmware Ver. 1.07 and earlier, and WCR-1166DS firmware Ver. 1.34 and earlier allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted request is sent to the management page.","status":"published","published":"2022-12-19T03:30:31Z","modified":"2025-04-17T15:33:30Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:01:36.418546Z"}],"nvd":[{"id":"CVE-2022-43443","description":"OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted request is sent to the management page.","status":"published","published":"2022-12-19T03:15:10.517Z","modified":"2026-06-17T05:06:33.41Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:07:34.031641Z"}]}}