{"id":"CVE-2022-43486","aliases":["EUVD-2022-46485","GHSA-2r4f-phw2-gpqp"],"status":"published","title":"Hidden functionality vulnerability in Buffalo network devices WSR-3200AX4S firmware Ver. 1.26 and...","description":"Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected devices.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00376,"percentile":0.32004,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2022-12-19T00:00:00Z","modified":"2026-06-17T05:06:39Z","products":[{"vendor":"buffalo","product":"wcr-1166ds_firmware"},{"vendor":"buffalo","product":"wex-1800ax4_firmware"},{"vendor":"buffalo","product":"wex-1800ax4ea_firmware"},{"vendor":"buffalo","product":"wsr-2533dhp2_firmware"},{"vendor":"buffalo","product":"wsr-2533dhp3_firmware"},{"vendor":"buffalo","product":"wsr-2533dhp_firmware"},{"vendor":"buffalo","product":"wsr-2533dhpl2_firmware"},{"vendor":"buffalo","product":"wsr-2533dhpl_firmware"},{"vendor":"buffalo","product":"wsr-2533dhpls_firmware"},{"vendor":"buffalo","product":"wsr-3200ax4b_firmware"},{"vendor":"buffalo","product":"wsr-3200ax4s_firmware"},{"vendor":"buffalo","product":"wsr-a2533dhp2_firmware"},{"vendor":"buffalo","product":"wsr-a2533dhp3_firmware"},{"vendor":"buffalo inc.","product":"wcr-1166ds"},{"vendor":"buffalo inc.","product":"wex-1800ax4"},{"vendor":"buffalo inc.","product":"wex-1800ax4ea"},{"vendor":"buffalo inc.","product":"wsr-2533dhp"},{"vendor":"buffalo inc.","product":"wsr-2533dhp2"},{"vendor":"buffalo inc.","product":"wsr-2533dhp3"},{"vendor":"buffalo inc.","product":"wsr-2533dhpl"},{"vendor":"buffalo inc.","product":"wsr-2533dhpl2"},{"vendor":"buffalo inc.","product":"wsr-2533dhplb"},{"vendor":"buffalo inc.","product":"wsr-2533dhpls"},{"vendor":"buffalo inc.","product":"wsr-3200ax4b"},{"vendor":"buffalo inc.","product":"wsr-3200ax4s"},{"vendor":"buffalo inc.","product":"wsr-a2533dhp2"},{"vendor":"buffalo inc.","product":"wsr-a2533dhp3"},{"vendor":"buffalo inc.","product":"wxr-5700ax7b"},{"vendor":"buffalo inc.","product":"wxr-5700ax7s"}],"references":[{"url":"https://www.buffalo.jp/news/detail/20240131-01.html","tags":["x_transferred"]},{"url":"https://jvn.jp/en/vu/JVNVU97099584/","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43486"},{"url":"https://jvn.jp/en/vu/JVNVU97099584/index.html"},{"url":"https://www.buffalo.jp/news/detail/20221205-01.html"},{"url":"https://jvn.jp/en/vu/JVNVU97099584"},{"url":"https://github.com/advisories/GHSA-2r4f-phw2-gpqp"}],"sources":{"cve":[{"id":"CVE-2022-43486","description":"Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected devices.","status":"published","published":"2022-12-19T00:00:00Z","modified":"2025-04-17T14:34:25.56Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:25.308772Z"}],"euvd":[{"id":"EUVD-2022-46485","description":"Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected devices.","status":"published","published":"2022-12-19T00:00:00Z","modified":"2025-04-17T14:34:25Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T20:52:21.593744Z"}],"ghsa":[{"id":"GHSA-2r4f-phw2-gpqp","title":"Hidden functionality vulnerability in Buffalo network devices WSR-3200AX4S firmware Ver. 1.26 and...","description":"Hidden functionality vulnerability in Buffalo network devices WSR-3200AX4S firmware Ver. 1.26 and earlier, WSR-3200AX4B firmware Ver. 1.25, WSR-2533DHP firmware Ver. 1.08 and earlier, WSR-2533DHP2 firmware Ver. 1.22 and earlier, WSR-A2533DHP2 firmware Ver. 1.22 and earlier, WSR-2533DHP3 firmware Ver. 1.26 and earlier, WSR-A2533DHP3 firmware Ver. 1.26 and earlier, WSR-2533DHPL firmware Ver. 1.08 and earlier, WSR-2533DHPL2 firmware Ver. 1.03 and earlier, WSR-2533DHPLS firmware Ver. 1.07 and earlier, WCR-1166DS firmware Ver. 1.34 and earlier, WEX-1800AX4 firmware Ver. 1.13 and earlier, and WEX-1800AX4EA firmware Ver. 1.13 and earlier allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected device.","status":"published","published":"2022-12-19T03:30:31Z","modified":"2025-04-17T15:33:30Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:01:36.418546Z"}],"nvd":[{"id":"CVE-2022-43486","description":"Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected devices.","status":"published","published":"2022-12-19T03:15:10.633Z","modified":"2026-06-17T05:06:39.02Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:07:34.031641Z"}]}}